mirror of
https://github.com/SabreTools/BinaryObjectScanner.git
synced 2026-04-29 01:50:24 +00:00
Add PE export table to builder
This commit is contained in:
@@ -64,6 +64,11 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
|
||||
#region Named Sections
|
||||
|
||||
/// <summary>
|
||||
/// Export table (.edata);
|
||||
/// </summary>
|
||||
public ExportTable ExportTable { get; set; }
|
||||
|
||||
/// <summary>
|
||||
/// Resource directory table (.rsrc)
|
||||
/// </summary>
|
||||
@@ -86,8 +91,8 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
// - [Export Ordinal Table]
|
||||
// - [Export Name Table]
|
||||
// - The .idata Section
|
||||
// - Import Lookup Table [has model, but bit-based]
|
||||
// - Import Address Table
|
||||
// - Import Lookup Table [has model, but bit-based]
|
||||
// - Import Address Table
|
||||
// - The .pdata Section [Multiple formats per entry]
|
||||
// - TLS Callback Functions
|
||||
// - The .cormeta Section (Object Only)
|
||||
|
||||
@@ -39,6 +39,11 @@ namespace BurnOutSharp.Models.PortableExecutable
|
||||
/// </summary>
|
||||
public uint NameRVA;
|
||||
|
||||
/// <summary>
|
||||
/// ASCII string that contains the name of the DLL.
|
||||
/// </summary>
|
||||
public string Name;
|
||||
|
||||
/// <summary>
|
||||
/// The starting ordinal number for exports in this image. This field specifies
|
||||
/// the starting ordinal number for the export address table. It is usually set
|
||||
|
||||
@@ -22,6 +22,6 @@
|
||||
/// <summary>
|
||||
/// A series of null-terminated ASCII strings of variable length.
|
||||
/// </summary>
|
||||
public string[] Indexes;
|
||||
public string[] Strings;
|
||||
}
|
||||
}
|
||||
|
||||
53
BurnOutSharp.Models/PortableExecutable/ExportTable.cs
Normal file
53
BurnOutSharp.Models/PortableExecutable/ExportTable.cs
Normal file
@@ -0,0 +1,53 @@
|
||||
namespace BurnOutSharp.Models.PortableExecutable
|
||||
{
|
||||
/// <summary>
|
||||
/// The export data section, named .edata, contains information about symbols that other images
|
||||
/// can access through dynamic linking. Exported symbols are generally found in DLLs, but DLLs
|
||||
/// can also import symbols.
|
||||
///
|
||||
/// An overview of the general structure of the export section is described below. The tables
|
||||
/// described are usually contiguous in the file in the order shown (though this is not
|
||||
/// required). Only the export directory table and export address table are required to export
|
||||
/// symbols as ordinals. (An ordinal is an export that is accessed directly by its export
|
||||
/// address table index.) The name pointer table, ordinal table, and export name table all
|
||||
/// exist to support use of export names.
|
||||
/// </summary>
|
||||
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
|
||||
public class ExportTable
|
||||
{
|
||||
/// <summary>
|
||||
/// A table with just one row (unlike the debug directory). This table indicates the
|
||||
/// locations and sizes of the other export tables.
|
||||
/// </summary>
|
||||
public ExportDirectoryTable ExportDirectoryTable;
|
||||
|
||||
/// <summary>
|
||||
/// An array of RVAs of exported symbols. These are the actual addresses of the exported
|
||||
/// functions and data within the executable code and data sections. Other image files
|
||||
/// can import a symbol by using an index to this table (an ordinal) or, optionally, by
|
||||
/// using the public name that corresponds to the ordinal if a public name is defined.
|
||||
/// </summary>
|
||||
public ExportAddressTableEntry[] ExportAddressTable;
|
||||
|
||||
/// <summary>
|
||||
/// An array of pointers to the public export names, sorted in ascending order.
|
||||
/// </summary>
|
||||
public ExportNamePointerTable NamePointerTable;
|
||||
|
||||
/// <summary>
|
||||
/// An array of the ordinals that correspond to members of the name pointer table. The
|
||||
/// correspondence is by position; therefore, the name pointer table and the ordinal table
|
||||
/// must have the same number of members. Each ordinal is an index into the export address
|
||||
/// table.
|
||||
/// </summary>
|
||||
public ExportOrdinalTable OrdinalTable;
|
||||
|
||||
/// <summary>
|
||||
/// A series of null-terminated ASCII strings. Members of the name pointer table point into
|
||||
/// this area. These names are the public names through which the symbols are imported and
|
||||
/// exported; they are not necessarily the same as the private names that are used within
|
||||
/// the image file.
|
||||
/// </summary>
|
||||
public ExportNameTable ExportNameTable;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user