usecrate::endian::{LittleEndian as LE, U16Bytes, U32Bytes}; usecrate::pe; usecrate::read::{ByteString, Bytes, Error, ReadError, ReadRef, Result};
/// Where an export is pointing to. #[derive(Clone, Copy)] pubenum ExportTarget<'data> { /// The address of the export, relative to the image base.
Address(u32), /// Forwarded to an export ordinal in another DLL. /// /// This gives the name of the DLL, and the ordinal.
ForwardByOrdinal(&'data [u8], u32), /// Forwarded to an export name in another DLL. /// /// This gives the name of the DLL, and the export name.
ForwardByName(&'data [u8], &'data [u8]),
}
impl<'data> ExportTarget<'data> { /// Returns true if the target is an address. pubfn is_address(&self) -> bool { matchself {
ExportTarget::Address(_) => true,
_ => false,
}
}
/// Returns true if the export is forwarded to another DLL. pubfn is_forward(&self) -> bool {
!self.is_address()
}
}
/// An export from a PE file. /// /// There are multiple kinds of PE exports (with or without a name, and local or forwarded). #[derive(Clone, Copy)] pubstruct Export<'data> { /// The ordinal of the export. /// /// These are sequential, starting at a base specified in the DLL. pub ordinal: u32, /// The name of the export, if known. pub name: Option<&'data [u8]>, /// The target of this export. pub target: ExportTarget<'data>,
}
/// A partially parsed PE export table. /// /// Returned by [`DataDirectories::export_table`](super::DataDirectories::export_table). #[derive(Debug, Clone)] pubstruct ExportTable<'data> {
data: Bytes<'data>,
virtual_address: u32,
directory: &'data pe::ImageExportDirectory,
addresses: &'data [U32Bytes<LE>],
names: &'data [U32Bytes<LE>],
name_ordinals: &'data [U16Bytes<LE>],
}
impl<'data> ExportTable<'data> { /// Parse the export table given its section data and address. pubfn parse(data: &'data [u8], virtual_address: u32) -> Result<Self> { let directory = Self::parse_directory(data)?; let data = Bytes(data);
letmut addresses = &[][..]; let address_of_functions = directory.address_of_functions.get(LE); if address_of_functions != 0 {
addresses = data
.read_slice_at::<U32Bytes<_>>(
address_of_functions.wrapping_sub(virtual_address) as usize,
directory.number_of_functions.get(LE) as usize,
)
.read_error("Invalid PE export address table")?;
}
letmut names = &[][..]; letmut name_ordinals = &[][..]; let address_of_names = directory.address_of_names.get(LE); let address_of_name_ordinals = directory.address_of_name_ordinals.get(LE); if address_of_names != 0 { if address_of_name_ordinals == 0 { return Err(Error("Missing PE export ordinal table"));
}
let number = directory.number_of_names.get(LE) as usize;
names = data
.read_slice_at::<U32Bytes<_>>(
address_of_names.wrapping_sub(virtual_address) as usize,
number,
)
.read_error("Invalid PE export name pointer table")?;
name_ordinals = data
.read_slice_at::<U16Bytes<_>>(
address_of_name_ordinals.wrapping_sub(virtual_address) as usize,
number,
)
.read_error("Invalid PE export ordinal table")?;
}
/// Parse the export directory given its section data. pubfn parse_directory(data: &'data [u8]) -> Result<&'data pe::ImageExportDirectory> {
data.read_at::<pe::ImageExportDirectory>(0)
.read_error("Invalid PE export dir size")
}
/// Returns the header of the export table. pubfn directory(&self) -> &'data pe::ImageExportDirectory { self.directory
}
/// Returns the base value of ordinals. /// /// Adding this to an address index will give an ordinal. pubfn ordinal_base(&self) -> u32 { self.directory.base.get(LE)
}
/// Returns the unparsed address table. /// /// An address table entry may be a local address, or the address of a forwarded export entry. /// See [`Self::is_forward`] and [`Self::target_from_address`]. pubfn addresses(&self) -> &'data [U32Bytes<LE>] { self.addresses
}
/// Returns the unparsed name pointer table. /// /// A name pointer table entry can be used with [`Self::name_from_pointer`]. pubfn name_pointers(&self) -> &'data [U32Bytes<LE>] { self.names
}
/// Returns the unparsed ordinal table. /// /// An ordinal table entry is a 0-based index into the address table. /// See [`Self::address_by_index`] and [`Self::target_by_index`]. pubfn name_ordinals(&self) -> &'data [U16Bytes<LE>] { self.name_ordinals
}
/// Returns an iterator for the entries in the name pointer table and ordinal table. /// /// A name pointer table entry can be used with [`Self::name_from_pointer`]. /// /// An ordinal table entry is a 0-based index into the address table. /// See [`Self::address_by_index`] and [`Self::target_by_index`]. pubfn name_iter(&self) -> impl Iterator<Item = (u32, u16)> + 'data { self.names
.iter()
.map(|x| x.get(LE))
.zip(self.name_ordinals.iter().map(|x| x.get(LE)))
}
/// Returns the export address table entry at the given address index. /// /// This may be a local address, or the address of a forwarded export entry. /// See [`Self::is_forward`] and [`Self::target_from_address`]. /// /// `index` is a 0-based index into the export address table. pubfn address_by_index(&self, index: u32) -> Result<u32> {
Ok(self
.addresses
.get(index as usize)
.read_error("Invalid PE export address index")?
.get(LE))
}
/// Returns the export address table entry at the given ordinal. /// /// This may be a local address, or the address of a forwarded export entry. /// See [`Self::is_forward`] and [`Self::target_from_address`]. pubfn address_by_ordinal(&self, ordinal: u32) -> Result<u32> { self.address_by_index(ordinal.wrapping_sub(self.ordinal_base()))
}
/// Returns the target of the export at the given address index. /// /// `index` is a 0-based index into the export address table. pubfn target_by_index(&self, index: u32) -> Result<ExportTarget<'data>> { self.target_from_address(self.address_by_index(index)?)
}
/// Returns the target of the export at the given ordinal. pubfn target_by_ordinal(&self, ordinal: u32) -> Result<ExportTarget<'data>> { self.target_from_address(self.address_by_ordinal(ordinal)?)
}
/// Convert an export address table entry into a target. pubfn target_from_address(&self, address: u32) -> Result<ExportTarget<'data>> {
Ok(iflet Some(forward) = self.forward_string(address)? { let i = forward
.iter()
.position(|x| *x == b'.')
.read_error("Missing PE forwarded export separator")?; let library = &forward[..i]; match &forward[i + 1..] {
[b'#', digits @ ..] => { let ordinal =
parse_ordinal(digits).read_error("Invalid PE forwarded export ordinal")?;
ExportTarget::ForwardByOrdinal(library, ordinal)
}
[] => { return Err(Error("Missing PE forwarded export name"));
}
name => ExportTarget::ForwardByName(library, name),
}
} else {
ExportTarget::Address(address)
})
}
fn forward_offset(&self, address: u32) -> Option<usize> { let offset = address.wrapping_sub(self.virtual_address) as usize; if offset < self.data.len() {
Some(offset)
} else {
None
}
}
/// Return true if the export address table entry is a forward. pubfn is_forward(&self, address: u32) -> bool { self.forward_offset(address).is_some()
}
/// Return the forward string if the export address table entry is a forward. pubfn forward_string(&self, address: u32) -> Result<Option<&yle='color:blue'>'data [u8]>> { iflet Some(offset) = self.forward_offset(address) { self.data
.read_string_at(offset)
.read_error("Invalid PE forwarded export address")
.map(Some)
} else {
Ok(None)
}
}
/// Convert an export name pointer table entry into a name. pubfn name_from_pointer(&self, name_pointer: u32) -> Result<&style='color:blue'>'data [u8]> { let offset = name_pointer.wrapping_sub(self.virtual_address); self.data
.read_string_at(offset as usize)
.read_error("Invalid PE export name pointer")
}
/// Returns the parsed exports in this table. pubfn exports(&self) -> Result<Vec<Export<'data>>> { // First, let's list all exports. letmut exports = Vec::new(); let ordinal_base = self.ordinal_base(); for (i, address) inself.addresses.iter().enumerate() { // Convert from an array index to an ordinal. let ordinal = ordinal_base.wrapping_add(i as u32); let target = self.target_from_address(address.get(LE))?;
exports.push(Export {
ordinal,
target, // Might be populated later.
name: None,
});
}
// Now, check whether some (or all) of them have an associated name. // `ordinal_index` is a 0-based index into `addresses`. for (name_pointer, ordinal_index) inself.name_iter() { let name = self.name_from_pointer(name_pointer)?;
exports
.get_mut(ordinal_index as usize)
.read_error("Invalid PE export ordinal")?
.name = Some(name);
}
Ok(exports)
}
}
fn parse_ordinal(digits: &[u8]) -> Option<u32> { if digits.is_empty() { return None;
} letmut result: u32 = 0; for &c in digits { let x = (c as char).to_digit(10)?;
result = result.checked_mul(10)?.checked_add(x)?;
}
Some(result)
}
Messung V0.5 in Prozent
¤ Dauer der Verarbeitung: 0.20 Sekunden
(vorverarbeitet am 2026-06-18)
¤
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.