Skip to content

Imports

Lloyd Kinsella edited this page Jul 7, 2016 · 6 revisions

To get the imported functions for a Portable Executable you can get the tables that build the imports individually or you can can just supply an ExecutableImage instance.

Example:

var image = ExecutableImage.Get(@"C:\Windows\explorer.exe");
var imports = Imports.Get(image);

Both Imports and ImportLibrary support IEnumerable<T> so you can easily iterate the imported libraries and functions.

Example:

foreach(ImportLibrary library in imports)
{
    Console.WriteLine("Library: " + library.Name);

    foreach(ImportLibraryFunction func in library)
    {
        if (func.BindingType == ImportLibraryBindingType.Name)
        {
            ImportLibraryNamedFunction named_func = (ImportLibraryNamedFunction)func;

            Console.WriteLine("    " + named_func.Name);
        }
        else
        {
            ImportLibraryOrdinalFunction ord_func = (ImportLibraryOrdinalFunction)func;

            Console.WriteLine("    #" + ord_func.Ordinal);
        }
    }
}

Clone this wiki locally