public ExportedFunctions ReadExports()
{
try {
var exportedFuncs = new ExportedFunctions();
ReadExports(exportedFuncs);
return(exportedFuncs);
}
catch (IOException) {
throw new DbgHookException($"Invalid PE file: {peImage.Filename}");
}
}
void ReadExports(ExportedFunctions exportedFuncs)
{
var exportHdr = peImage.ImageNTHeaders.OptionalHeader.DataDirectories[0];
if (exportHdr.VirtualAddress == 0 || exportHdr.Size < 0x28)
{
return;
}
var reader = peImage.CreateReader();
reader.Position = (uint)peImage.ToFileOffset(exportHdr.VirtualAddress);
reader.Position += 16;
uint ordinalBase = reader.ReadUInt32();
int numFuncs = reader.ReadInt32();
int numNames = reader.ReadInt32();
uint offsetOfFuncs = (uint)peImage.ToFileOffset((RVA)reader.ReadUInt32());
uint offsetOfNames = (uint)peImage.ToFileOffset((RVA)reader.ReadUInt32());
uint offsetOfNameIndexes = (uint)peImage.ToFileOffset((RVA)reader.ReadUInt32());
var names = ReadNames(ref reader, peImage, numNames, offsetOfNames, offsetOfNameIndexes);
reader.Position = offsetOfFuncs;
var allRvas = new uint[numFuncs];
for (int i = 0; i < numFuncs; i++)
{
uint rva = reader.ReadUInt32();
allRvas[i] = rva;
if (rva != 0)
{
exportedFuncs.Add((ushort)(ordinalBase + (uint)i), baseAddress + rva);
}
}
foreach (var info in names)
{
int index = info.index;
if ((uint)index >= (uint)allRvas.Length)
{
continue;
}
uint rva = allRvas[index];
if (rva == 0)
{
continue;
}
exportedFuncs.Add(info.name, baseAddress + rva);
}
}
