From f323ae3c3056a470ecb181634e676a036d64333f Mon Sep 17 00:00:00 2001
From: Llod Kinsella <lloydkinsella@gmail.com>
Date: Mon, 8 Feb 2016 19:18:32 +0000
Subject: [PATCH] More work on the Import table.

---
 .../Content/Imports/ImportFunction.cs         | 145 ++++++++++++++++++
 .../Content/Imports/ImportLibrary.cs          | 116 ++++++++++++++
 Src/Workshell.PE/Workshell.PE.csproj          |   2 +
 3 files changed, 263 insertions(+)
 create mode 100644 Src/Workshell.PE/Content/Imports/ImportFunction.cs
 create mode 100644 Src/Workshell.PE/Content/Imports/ImportLibrary.cs

diff --git a/Src/Workshell.PE/Content/Imports/ImportFunction.cs b/Src/Workshell.PE/Content/Imports/ImportFunction.cs
new file mode 100644
index 0000000..0b24499
--- /dev/null
+++ b/Src/Workshell.PE/Content/Imports/ImportFunction.cs
@@ -0,0 +1,145 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Workshell.PE
+{
+
+    public enum ImportLibraryBindingType
+    {
+        Name,
+        Ordinal
+    }
+
+    public abstract class ImportLibraryFunction
+    {
+
+        private ImportLibrary library;
+        private ImportAddressTableEntry table_entry;
+
+        internal ImportLibraryFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry)
+        {
+            library = importLibrary;
+            table_entry = tableEntry;
+        }
+
+        #region Properties
+
+        public ImportLibrary Library
+        {
+            get
+            {
+                return library;
+            }
+        }
+
+        public ImportAddressTableEntry TableEntry
+        {
+            get
+            {
+                return table_entry;
+            }
+        }
+
+        public abstract ImportLibraryBindingType BindingType
+        {
+            get;
+        }
+
+        #endregion
+
+    }
+
+    public class ImportLibraryOrdinalFunction : ImportLibraryFunction
+    {
+
+        private int ordinal;
+
+        internal ImportLibraryOrdinalFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry, int ordinalNo) : base(importLibrary, tableEntry)
+        {
+            ordinal = ordinalNo;
+        }
+
+        #region Methods
+
+        public override string ToString()
+        {
+            return String.Format("{0:D4} (0x{1})", ordinal, ordinal.ToString("X4"));
+        }
+
+        #endregion
+
+        #region Properties
+
+        public override ImportLibraryBindingType BindingType
+        {
+            get
+            {
+                return ImportLibraryBindingType.Ordinal;
+            }
+        }
+
+        public int Ordinal
+        {
+            get
+            {
+                return ordinal;
+            }
+        }
+
+        #endregion
+
+    }
+
+    public class ImportLibraryNamedFunction : ImportLibraryFunction
+    {
+
+        private ImportHintNameEntry hint_entry;
+
+        internal ImportLibraryNamedFunction(ImportLibrary importLibrary, ImportAddressTableEntry tableEntry, ImportHintNameEntry hintEntry) : base(importLibrary, tableEntry)
+        {
+            hint_entry = hintEntry;
+        }
+
+        #region Methods
+
+        public override string ToString()
+        {
+            return hint_entry.ToString();
+        }
+
+        #endregion
+
+        #region Properties
+
+        public override ImportLibraryBindingType BindingType
+        {
+            get
+            {
+                return ImportLibraryBindingType.Name;
+            }
+        }
+
+        public ImportHintNameEntry HintEntry
+        {
+            get
+            {
+                return hint_entry;
+            }
+        }
+
+        public string Name
+        {
+            get
+            {
+                return hint_entry.Name;
+            }
+        }
+
+        #endregion
+
+    }
+
+}
diff --git a/Src/Workshell.PE/Content/Imports/ImportLibrary.cs b/Src/Workshell.PE/Content/Imports/ImportLibrary.cs
new file mode 100644
index 0000000..024fed7
--- /dev/null
+++ b/Src/Workshell.PE/Content/Imports/ImportLibrary.cs
@@ -0,0 +1,116 @@
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace Workshell.PE
+{
+
+    public class ImportLibrary : IEnumerable<ImportLibraryFunction>
+    {
+
+        private ImportTableContent content;
+        private ImportAddressTable table;
+        private string name;
+        private List<ImportLibraryFunction> functions;
+
+        internal ImportLibrary(ImportTableContent tableContent, ImportAddressTable addressTable, string libraryName)
+        {
+            content = tableContent;
+            table = addressTable;
+            name = libraryName;
+            functions = new List<ImportLibraryFunction>();
+
+            LoadFunctions();
+        }
+
+        #region Methods
+
+        public IEnumerator<ImportLibraryFunction> GetEnumerator()
+        {
+            return functions.GetEnumerator();
+        }
+
+        System.Collections.IEnumerator System.Collections.IEnumerable.GetEnumerator()
+        {
+            return GetEnumerator();
+        }
+
+        public override string ToString()
+        {
+            return String.Format("Name: {0}, Imported Function Count: {1}", name, functions.Count);
+        }
+
+        private void LoadFunctions()
+        {
+            foreach (ImportAddressTableEntry entry in table)
+            {
+                ImportLibraryFunction func;
+
+                if (entry.IsOrdinal)
+                {
+                    func = new ImportLibraryOrdinalFunction(this, entry, entry.Ordinal);
+                }
+                else
+                {
+                    ImportHintNameEntry hint_entry = content.HintNameTable.FirstOrDefault(hne => hne.Location.VirtualAddress == entry.Address);
+
+                    if (hint_entry != null)
+                        func = new ImportLibraryNamedFunction(this, entry, hint_entry);
+                }
+
+                functions.Add(func);
+            }
+        }
+
+        #endregion
+
+        #region Properties
+
+        public ImportTableContent Content
+        {
+            get
+            {
+                return content;
+            }
+        }
+
+        public ImportAddressTable Table
+        {
+            get
+            {
+                return table;
+            }
+        }
+
+        public string Name
+        {
+            get
+            {
+                return name;
+            }
+        }
+
+        public int Count
+        {
+            get
+            {
+                return functions.Count;
+            }
+        }
+
+        public ImportLibraryFunction this[int index]
+        {
+            get
+            {
+                return functions[index];
+            }
+        }
+
+        #endregion
+
+    }
+
+}
diff --git a/Src/Workshell.PE/Workshell.PE.csproj b/Src/Workshell.PE/Workshell.PE.csproj
index 5875fda..3e9ba0f 100644
--- a/Src/Workshell.PE/Workshell.PE.csproj
+++ b/Src/Workshell.PE/Workshell.PE.csproj
@@ -49,7 +49,9 @@
     <Compile Include="Content\Exports\ExportTable.cs" />
     <Compile Include="Content\Exports\ExportTableContent.cs" />
     <Compile Include="Content\Imports\ImportAddressTable.cs" />
+    <Compile Include="Content\Imports\ImportFunction.cs" />
     <Compile Include="Content\Imports\ImportHintNameTable.cs" />
+    <Compile Include="Content\Imports\ImportLibrary.cs" />
     <Compile Include="Content\Imports\ImportTableContent.cs" />
     <Compile Include="Content\Imports\ImportDirectory.cs" />
     <Compile Include="DataDirectory.cs" />