Add PE export table to builder

This commit is contained in:
Matt Nadareski
2022-11-09 23:06:52 -08:00
parent 0768a93bcb
commit 5ba2a31d7d
5 changed files with 334 additions and 3 deletions

View File

@@ -64,6 +64,11 @@ namespace BurnOutSharp.Models.PortableExecutable
#region Named Sections
/// <summary>
/// Export table (.edata);
/// </summary>
public ExportTable ExportTable { get; set; }
/// <summary>
/// Resource directory table (.rsrc)
/// </summary>
@@ -86,8 +91,8 @@ namespace BurnOutSharp.Models.PortableExecutable
// - [Export Ordinal Table]
// - [Export Name Table]
// - The .idata Section
// - Import Lookup Table [has model, but bit-based]
// - Import Address Table
// - Import Lookup Table [has model, but bit-based]
// - Import Address Table
// - The .pdata Section [Multiple formats per entry]
// - TLS Callback Functions
// - The .cormeta Section (Object Only)

View File

@@ -39,6 +39,11 @@ namespace BurnOutSharp.Models.PortableExecutable
/// </summary>
public uint NameRVA;
/// <summary>
/// ASCII string that contains the name of the DLL.
/// </summary>
public string Name;
/// <summary>
/// The starting ordinal number for exports in this image. This field specifies
/// the starting ordinal number for the export address table. It is usually set

View File

@@ -22,6 +22,6 @@
/// <summary>
/// A series of null-terminated ASCII strings of variable length.
/// </summary>
public string[] Indexes;
public string[] Strings;
}
}

View File

@@ -0,0 +1,53 @@
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// The export data section, named .edata, contains information about symbols that other images
/// can access through dynamic linking. Exported symbols are generally found in DLLs, but DLLs
/// can also import symbols.
///
/// An overview of the general structure of the export section is described below. The tables
/// described are usually contiguous in the file in the order shown (though this is not
/// required). Only the export directory table and export address table are required to export
/// symbols as ordinals. (An ordinal is an export that is accessed directly by its export
/// address table index.) The name pointer table, ordinal table, and export name table all
/// exist to support use of export names.
/// </summary>
/// <see href="https://learn.microsoft.com/en-us/windows/win32/debug/pe-format"/>
public class ExportTable
{
/// <summary>
/// A table with just one row (unlike the debug directory). This table indicates the
/// locations and sizes of the other export tables.
/// </summary>
public ExportDirectoryTable ExportDirectoryTable;
/// <summary>
/// An array of RVAs of exported symbols. These are the actual addresses of the exported
/// functions and data within the executable code and data sections. Other image files
/// can import a symbol by using an index to this table (an ordinal) or, optionally, by
/// using the public name that corresponds to the ordinal if a public name is defined.
/// </summary>
public ExportAddressTableEntry[] ExportAddressTable;
/// <summary>
/// An array of pointers to the public export names, sorted in ascending order.
/// </summary>
public ExportNamePointerTable NamePointerTable;
/// <summary>
/// An array of the ordinals that correspond to members of the name pointer table. The
/// correspondence is by position; therefore, the name pointer table and the ordinal table
/// must have the same number of members. Each ordinal is an index into the export address
/// table.
/// </summary>
public ExportOrdinalTable OrdinalTable;
/// <summary>
/// A series of null-terminated ASCII strings. Members of the name pointer table point into
/// this area. These names are the public names through which the symbols are imported and
/// exported; they are not necessarily the same as the private names that are used within
/// the image file.
/// </summary>
public ExportNameTable ExportNameTable;
}
}