Method GetExports

PEParser/PEParser.cpp:122–175

}

std::vector<ExportedSymbol> PEParser::GetExports() const {
	std::vector<ExportedSymbol> exports;
	if (!HasExports())
		return exports;
	auto dir = GetDataDirectory(IMAGE_DIRECTORY_ENTRY_EXPORT);
	if (dir == nullptr || dir->Size == 0)
		return exports;

	auto data = static_cast<IMAGE_EXPORT_DIRECTORY*>(GetAddress(dir->VirtualAddress));
	auto count = data->NumberOfFunctions;
	exports.reserve(count);

	auto names = (PBYTE)(data->AddressOfNames != 0 ? GetAddress(data->AddressOfNames) : nullptr);
	auto ordinals = (PBYTE)(data->AddressOfNameOrdinals != 0 ? GetAddress(data->AddressOfNameOrdinals) : nullptr);
	auto functions = (PDWORD)GetAddress(data->AddressOfFunctions);
	char undecorated[1 << 10];
	auto ordinalBase = data->Base;

	std::unordered_map<uint32_t, std::string> functionNamesMap;
	for (uint32_t idx = 0; idx < data->NumberOfNames; idx++) {
		uint16_t ordinal;
		ordinal = *(USHORT*)(ordinals + idx * 2) + (USHORT)ordinalBase;
		uint32_t name;
		auto offset = *(ULONG*)(names + idx * 4);
		functionNamesMap[ordinal] = (PCSTR)GetAddress(offset);
	}

	for (DWORD i = 0; i < data->NumberOfFunctions; i++) {
		ExportedSymbol symbol;
		int ordinal = i + (USHORT)ordinalBase;
		symbol.Ordinal = ordinal;
		bool hasName = false;
		auto pos = functionNamesMap.find(ordinal);
		if (pos != functionNamesMap.end()) {
			hasName = true;
		}
		if (names && hasName) {
			symbol.Name = pos->second;
			if (::UnDecorateSymbolName(symbol.Name.c_str(), undecorated, sizeof(undecorated), 0))
				symbol.UndecoratedName = undecorated;
		}
		DWORD address = *(functions + symbol.Ordinal - ordinalBase);
		symbol.Address = address;
		//auto offset = RvaToFileOffset(address);
		if (hasName) {
			if (address > dir->VirtualAddress && address < dir->VirtualAddress + dir->Size) {
				symbol.ForwardName = (PCSTR)GetAddress(address);
			}
		}
		exports.push_back(std::move(symbol));
	}

	return exports;
}

std::vector<ImportedLibrary> PEParser::GetImports() const {
	std::vector<ImportedLibrary> libs;