public struct IMAGE_EXPORT_DIRECTORY
{
0x00 public UInt32 Characteristics;
0x04 public UInt32 TimeDateStamp;
0x08 public UInt16 MajorVersion;
0x0a public UInt16 MinorVersion;
0x0c public UInt32 Name;
0x10 public UInt32 Base;
0x14 public UInt32 NumberOfFunctions;
0x18 public UInt32 NumberOfNames;
0x1c public UInt32 AddressOfFunctions; // RVA from base of image
0x20 public UInt32 AddressOfNames; // RVA from base of image
0x24 public UInt32 AddressOfNameOrdinals; // RVA from base of image
}
{
0x00 public UInt32 Characteristics;
0x04 public UInt32 TimeDateStamp;
0x08 public UInt16 MajorVersion;
0x0a public UInt16 MinorVersion;
0x0c public UInt32 Name;
0x10 public UInt32 Base;
0x14 public UInt32 NumberOfFunctions;
0x18 public UInt32 NumberOfNames;
0x1c public UInt32 AddressOfFunctions; // RVA from base of image
0x20 public UInt32 AddressOfNames; // RVA from base of image
0x24 public UInt32 AddressOfNameOrdinals; // RVA from base of image
}
imageBase + DataDirectories[ExportDir RVA] = adalah pointer kepada struktur kat atas
No comments:
Post a Comment
Terima kasih