diff --git a/src/file_format/pe.rs b/src/file_format/pe.rs index 101ac17..2f10689 100644 --- a/src/file_format/pe.rs +++ b/src/file_format/pe.rs @@ -100,9 +100,10 @@ struct OptionalCOFFHeader { struct ExportedSymbolsTableDef { _unk: [u8; 0x14], number_of_functions: u32, - _unk_1: u32, + number_of_names: u32, function_address_array_index: u32, function_name_array_index: u32, + name_ordinals_array_index: u32, } /// The machine type (architecture) of a module in a process. An image file can @@ -340,12 +341,20 @@ pub fn symbols( } .unwrap_or_default(); - (0..symbols_def.number_of_functions).filter_map(move |i| { + (0..symbols_def.number_of_names).filter_map(move |i| { + let ordinal = process + .read::(address + symbols_def.name_ordinals_array_index + i.wrapping_mul(2)) + .ok() + .map(|val| val as u32) + .filter(|&val| val < symbols_def.number_of_functions)?; + Some(Symbol { address: address + process .read::( - address + symbols_def.function_address_array_index + i.wrapping_mul(4), + address + + symbols_def.function_address_array_index + + ordinal.wrapping_mul(4), ) .ok()?, name_addr: address