-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
3 changed files
with
263 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,145 @@ | ||
using System; | ||
using System.Collections.Generic; | ||
using System.Linq; | ||
using System.Text; | ||
using System.Threading.Tasks; | ||
|
||
namespace Workshell.PE | ||
{ | ||
|
||
public enum ImportLibraryBindingType | ||
{ | ||
Name, | ||
Ordinal | ||
} | ||
|
||
public abstract class ImportLibraryFunction | ||
{ | ||
|
||
private ImportLibrary library; | ||
private ImportAddressTableEntry table_entry; | ||
|
||
internal ImportLibraryFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry) | ||
{ | ||
library = importLibrary; | ||
table_entry = tableEntry; | ||
} | ||
|
||
#region Properties | ||
|
||
public ImportLibrary Library | ||
{ | ||
get | ||
{ | ||
return library; | ||
} | ||
} | ||
|
||
public ImportAddressTableEntry TableEntry | ||
{ | ||
get | ||
{ | ||
return table_entry; | ||
} | ||
} | ||
|
||
public abstract ImportLibraryBindingType BindingType | ||
{ | ||
get; | ||
} | ||
|
||
#endregion | ||
|
||
} | ||
|
||
public class ImportLibraryOrdinalFunction : ImportLibraryFunction | ||
{ | ||
|
||
private int ordinal; | ||
|
||
internal ImportLibraryOrdinalFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry, int ordinalNo) : base(importLibrary, tableEntry) | ||
{ | ||
ordinal = ordinalNo; | ||
} | ||
|
||
#region Methods | ||
|
||
public override string ToString() | ||
{ | ||
return String.Format("{0:D4} (0x{1})", ordinal, ordinal.ToString("X4")); | ||
} | ||
|
||
#endregion | ||
|
||
#region Properties | ||
|
||
public override ImportLibraryBindingType BindingType | ||
{ | ||
get | ||
{ | ||
return ImportLibraryBindingType.Ordinal; | ||
} | ||
} | ||
|
||
public int Ordinal | ||
{ | ||
get | ||
{ | ||
return ordinal; | ||
} | ||
} | ||
|
||
#endregion | ||
|
||
} | ||
|
||
public class ImportLibraryNamedFunction : ImportLibraryFunction | ||
{ | ||
|
||
private ImportHintNameEntry hint_entry; | ||
|
||
internal ImportLibraryNamedFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry, ImportHintNameEntry hintEntry) : base(importLibrary, tableEntry) | ||
{ | ||
hint_entry = hintEntry; | ||
} | ||
|
||
#region Methods | ||
|
||
public override string ToString() | ||
{ | ||
return hint_entry.ToString(); | ||
} | ||
|
||
#endregion | ||
|
||
#region Properties | ||
|
||
public override ImportLibraryBindingType BindingType | ||
{ | ||
get | ||
{ | ||
return ImportLibraryBindingType.Name; | ||
} | ||
} | ||
|
||
public ImportHintNameEntry HintEntry | ||
{ | ||
get | ||
{ | ||
return hint_entry; | ||
} | ||
} | ||
|
||
public string Name | ||
{ | ||
get | ||
{ | ||
return hint_entry.Name; | ||
} | ||
} | ||
|
||
#endregion | ||
|
||
} | ||
|
||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,116 @@ | ||
using System; | ||
using System.Collections.Generic; | ||
using System.IO; | ||
using System.Linq; | ||
using System.Text; | ||
using System.Threading.Tasks; | ||
|
||
namespace Workshell.PE | ||
{ | ||
|
||
public class ImportLibrary : IEnumerable<ImportLibraryFunction> | ||
{ | ||
|
||
private ImportTableContent content; | ||
private ImportAddressTable table; | ||
private string name; | ||
private List<ImportLibraryFunction> functions; | ||
|
||
internal ImportLibrary(ImportTableContent tableContent, ImportAddressTable addressTable, string libraryName) | ||
{ | ||
content = tableContent; | ||
table = addressTable; | ||
name = libraryName; | ||
functions = new List<ImportLibraryFunction>(); | ||
|
||
LoadFunctions(); | ||
} | ||
|
||
#region Methods | ||
|
||
public IEnumerator<ImportLibraryFunction> GetEnumerator() | ||
{ | ||
return functions.GetEnumerator(); | ||
} | ||
|
||
System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator() | ||
{ | ||
return GetEnumerator(); | ||
} | ||
|
||
public override string ToString() | ||
{ | ||
return String.Format("Name: {0}, Imported Function Count: {1}", name, functions.Count); | ||
} | ||
|
||
private void LoadFunctions() | ||
{ | ||
foreach (ImportAddressTableEntry entry in table) | ||
{ | ||
ImportLibraryFunction func; | ||
|
||
if (entry.IsOrdinal) | ||
{ | ||
func = new ImportLibraryOrdinalFunction(this, entry, entry.Ordinal); | ||
} | ||
else | ||
{ | ||
ImportHintNameEntry hint_entry = content.HintNameTable.FirstOrDefault(hne => hne.Location.VirtualAddress == entry.Address); | ||
|
||
if (hint_entry != null) | ||
func = new ImportLibraryNamedFunction(this, entry, hint_entry); | ||
} | ||
|
||
functions.Add(func); | ||
} | ||
} | ||
|
||
#endregion | ||
|
||
#region Properties | ||
|
||
public ImportTableContent Content | ||
{ | ||
get | ||
{ | ||
return content; | ||
} | ||
} | ||
|
||
public ImportAddressTable Table | ||
{ | ||
get | ||
{ | ||
return table; | ||
} | ||
} | ||
|
||
public string Name | ||
{ | ||
get | ||
{ | ||
return name; | ||
} | ||
} | ||
|
||
public int Count | ||
{ | ||
get | ||
{ | ||
return functions.Count; | ||
} | ||
} | ||
|
||
public ImportLibraryFunction this[int index] | ||
{ | ||
get | ||
{ | ||
return functions[index]; | ||
} | ||
} | ||
|
||
#endregion | ||
|
||
} | ||
|
||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters