| 379 | } |
| 380 | |
| 381 | void ApiReader::parseExportTable(ModuleInfo *module, PIMAGE_NT_HEADERS pNtHeader, PIMAGE_EXPORT_DIRECTORY pExportDir, DWORD_PTR deltaAddress) |
| 382 | { |
| 383 | DWORD *addressOfFunctionsArray = 0,*addressOfNamesArray = 0; |
| 384 | WORD *addressOfNameOrdinalsArray = 0; |
| 385 | char *functionName = 0; |
| 386 | DWORD_PTR RVA = 0, VA = 0; |
| 387 | WORD ordinal = 0; |
| 388 | WORD i = 0, j = 0; |
| 389 | bool withoutName; |
| 390 | |
| 391 | |
| 392 | addressOfFunctionsArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfFunctions + deltaAddress); |
| 393 | addressOfNamesArray = (DWORD *)((DWORD_PTR)pExportDir->AddressOfNames + deltaAddress); |
| 394 | addressOfNameOrdinalsArray = (WORD *)((DWORD_PTR)pExportDir->AddressOfNameOrdinals + deltaAddress); |
| 395 | |
| 396 | #ifdef DEBUG_COMMENTS |
| 397 | Scylla::debugLog.log(L"parseExportTable :: module %s NumberOfNames %X", module->fullPath, pExportDir->NumberOfNames); |
| 398 | #endif |
| 399 | |
| 400 | for (i = 0; i < pExportDir->NumberOfNames; i++) |
| 401 | { |
| 402 | functionName = (char*)(addressOfNamesArray[i] + deltaAddress); |
| 403 | ordinal = (WORD)(addressOfNameOrdinalsArray[i] + pExportDir->Base); |
| 404 | RVA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]]; |
| 405 | VA = addressOfFunctionsArray[addressOfNameOrdinalsArray[i]] + module->modBaseAddr; |
| 406 | |
| 407 | #ifdef DEBUG_COMMENTS |
| 408 | Scylla::debugLog.log(L"parseExportTable :: api %S ordinal %d imagebase " PRINTF_DWORD_PTR_FULL L" RVA " PRINTF_DWORD_PTR_FULL L" VA " PRINTF_DWORD_PTR_FULL, functionName, ordinal, module->modBaseAddr, RVA, VA); |
| 409 | #endif |
| 410 | if (!isApiBlacklisted(functionName)) |
| 411 | { |
| 412 | if (!isApiForwarded(RVA,pNtHeader)) |
| 413 | { |
| 414 | addApi(functionName, i, ordinal,VA,RVA,false,module); |
| 415 | } |
| 416 | else |
| 417 | { |
| 418 | //printf("Forwarded: %s\n",functionName); |
| 419 | handleForwardedApi(RVA + deltaAddress,functionName,RVA,ordinal,module); |
| 420 | } |
| 421 | } |
| 422 | |
| 423 | } |
| 424 | |
| 425 | /*Exports without name*/ |
| 426 | if (pExportDir->NumberOfNames != pExportDir->NumberOfFunctions) |
| 427 | { |
| 428 | for (i = 0; i < pExportDir->NumberOfFunctions; i++) |
| 429 | { |
| 430 | withoutName = true; |
| 431 | for (j = 0; j < pExportDir->NumberOfNames; j++) |
| 432 | { |
| 433 | if(addressOfNameOrdinalsArray[j] == i) |
| 434 | { |
| 435 | withoutName = false; |
| 436 | break; |
| 437 | } |
| 438 | } |