• R/O
  • SSH
  • HTTPS

peframework: Commit


Commit MetaInfo

Revision32 (tree)
Time2019-09-29 00:29:36
Authorquiret

Log Message

- implemented reading of PEImportDesc functions entries by IAT thunk copy because MSFT's PE loader does so aswell

Change Summary

Incremental Difference

--- library/src/peloader.read.cpp (revision 31)
+++ library/src/peloader.read.cpp (revision 32)
@@ -1067,6 +1067,14 @@
10671067 sections, importInfo.Characteristics, impDesc.impNameArrayAllocEntry, isExtendedFormat
10681068 );
10691069 }
1070+ else if ( importInfo.FirstThunk != 0 )
1071+ {
1072+ // Some images are known to skip the Characteristics array to save space.
1073+ impDesc.funcs =
1074+ PEImportDesc::ReadPEImportFunctions(
1075+ sections, importInfo.FirstThunk, impDesc.impNameArrayAllocEntry, isExtendedFormat
1076+ );
1077+ }
10701078
10711079 // Store the DLL name we import from.
10721080 {
Show on old repository browser