SabreTools/BinaryObjectScanner
1
0
Fork 0
mirror of https://github.com/SabreTools/BinaryObjectScanner.git synced 2026-07-18 14:55:05 +00:00
Code Issues 295 Packages Projects Releases 20 Wiki Activity

Add initial PE import table parsing

Browse Source
This commit is contained in:
Matt Nadareski
2022-11-10 11:31:06 -08:00
parent 98ddc65fa2
commit c77c095893
3 changed files with 361 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
BurnOutSharp.Models/PortableExecutable/ImportDirectoryTableEntry.cs
View File

@@ -39,10 +39,15 @@ namespace BurnOutSharp.Models.PortableExecutable
/// </summary>
public uint NameRVA;
/// <summary>
/// ASCII string that contains the name of the DLL.
/// </summary>
public string Name;
/// <summary>
/// The RVA of the import address table. The contents of this table are identical
/// to the contents of the import lookup table until the image is bound.
/// </summary>
public uint ImportAddressTableRVAThunkTable;
public uint ImportAddressTableRVA;
}
}

10
BurnOutSharp.Models/PortableExecutable/ImportTable.cs
View File

@@ -1,4 +1,6 @@
namespace BurnOutSharp.Models.PortableExecutable
using System.Collections.Generic;
namespace BurnOutSharp.Models.PortableExecutable
{
/// <summary>
/// All image files that import symbols, including virtually all executable (EXE) files,
@@ -27,13 +29,13 @@
/// An import lookup table is an array of 32-bit numbers for PE32 or an array of 64-bit
/// numbers for PE32+.
/// </summary>
public ImportLookupTableEntry[,] ImportLookupTable;
public Dictionary<int, ImportLookupTableEntry[]> ImportLookupTables;
/// <summary>
/// These addresses are the actual memory addresses of the symbols, although technically
/// they are still called "virtual addresses.
/// they are still called "virtual addresses".
/// </summary>
public ImportAddressTableEntry[,] ImportAddressTable;
public Dictionary<int, ImportAddressTableEntry[]> ImportAddressTables;
/// <summary>
/// One hint/name table suffices for the entire import section.