-
Notifications
You must be signed in to change notification settings - Fork 6
Imports
Lloyd Kinsella edited this page Jul 7, 2016
·
6 revisions
To get the imported functions for a Portable Executable you can get the tables that build the imports individually or you can can just supply an ExecutableImage instance.
Example:
var image = ExecutableImage.Get(@"C:\Windows\explorer.exe");
var imports = Imports.Get(image);
Both Imports and ImportLibrary support IEnumerable<T> so you can easily iterate the imported libraries and functions.
Example:
foreach(ImportLibrary library in imports)
{
Console.WriteLine("Library: " + library.Name);
foreach(ImportLibraryFunction func in library)
{
if (func.BindingType == ImportLibraryBindingType.Name)
{
ImportLibraryNamedFunction named_func = (ImportLibraryNamedFunction)func;
Console.WriteLine(" " + named_func.Name);
}
else
{
ImportLibraryOrdinalFunction ord_func = (ImportLibraryOrdinalFunction)func;
Console.WriteLine(" #" + ord_func.Ordinal);
}
}
}