MCPcopy Create free account
hub / github.com/ELMERIKH/PyinMemoryPE / exports

Method exports

windows/pe_parse.py:400–422  ·  view source on GitHub ↗

The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`). The values are the addresses of the exports. :type: {(:class:`int` or :class:`str`) : :class:`int`}

(self)

Source from the content-addressed store, hash-verified

398
399 @utils.fixedpropety
400 def exports(self):
401 """The exports of the PE in a dict. Keys are ordinal (:class:`int`) and name (:class:`str`).
402 The values are the addresses of the exports.
403
404 :type: {(:class:`int` or :class:`str`) : :class:`int`}"""
405 res = {}
406 exp_dir = self.get_EXPORT_DIRECTORY()
407 export_datadir = self.get_DataDirectory()[IMAGE_DIRECTORY_ENTRY_EXPORT]
408 export_start = self.baseaddr + export_datadir.VirtualAddress
409 export_end = export_start + export_datadir.Size
410 if exp_dir is None:
411 return res
412 raw_exports = exp_dir.get_exports()
413 for id, rva_addr, rva_name in raw_exports:
414 if export_start <= rva_addr < export_end:
415 # Export proxy...
416 # Contains the string to another Dll.Function
417 rva_addr = get_string(self.target, rva_addr) # Put the string proxy instead
418
419 res[id] = rva_addr
420 if rva_name is not None:
421 res[rva_name] = rva_addr
422 return res
423
424 @utils.fixedpropety
425 def export_name(self):

Callers

nothing calls this directly

Calls 4

get_EXPORT_DIRECTORYMethod · 0.95
get_DataDirectoryMethod · 0.95
get_stringFunction · 0.85
get_exportsMethod · 0.80

Tested by

no test coverage detected