using System.Runtime.InteropServices; namespace BinaryObjectScanner.Models.PortableExecutable { /// /// The export symbol information begins with the export directory table, /// which describes the remainder of the export symbol information. The /// export directory table contains address information that is used to resolve /// imports to the entry points within this image. /// /// [StructLayout(LayoutKind.Sequential)] public sealed class ExportDirectoryTable { /// /// Reserved, must be 0. /// public uint ExportFlags; /// /// The time and date that the export data was created. /// public uint TimeDateStamp; /// /// The major version number. The major and minor version numbers can be set /// by the user. /// public ushort MajorVersion; /// /// The minor version number. /// public ushort MinorVersion; /// /// The address of the ASCII string that contains the name of the DLL. This /// address is relative to the image base. /// public uint NameRVA; /// /// ASCII string that contains the name of the DLL. /// public string Name; /// /// The starting ordinal number for exports in this image. This field specifies /// the starting ordinal number for the export address table. It is usually set /// to 1. /// public uint OrdinalBase; /// /// The number of entries in the export address table. /// public uint AddressTableEntries; /// /// The number of entries in the name pointer table. This is also the number of /// entries in the ordinal table. /// public uint NumberOfNamePointers; /// /// The address of the export address table, relative to the image base. /// public uint ExportAddressTableRVA; /// /// The address of the export name pointer table, relative to the image base. /// The table size is given by the Number of Name Pointers field. /// public uint NamePointerRVA; /// /// The address of the ordinal table, relative to the image base. /// public uint OrdinalTableRVA; } }