static int GetTokenFromExportOrdinal(Module module, ExportDirectoryTable edt, int ordinal)
{
PortableExecutableKinds peKind;
ImageFileMachine machine;
module.GetPEKind(out peKind, out machine);
byte[] buf = new byte[16];
module.__ReadDataFromRVA((int)edt.ExportAddressTableRVA + (int)(ordinal - edt.OrdinalBase) * 4, buf, 0, 4);
int exportRVA = BitConverter.ToInt32(buf, 0);
if (machine == ImageFileMachine.ARM)
{
// mask out the instruction set selection flag
exportRVA &= ~1;
}
module.__ReadDataFromRVA(exportRVA, buf, 0, 16);
int offset;
if (machine == ImageFileMachine.I386 && buf[0] == 0xFF && buf[1] == 0x25)
{
// for x86 the code here is:
// FF 25 00 40 40 00 jmp dword ptr ds:[00404000h]
offset = 2;
}
else if (machine == ImageFileMachine.AMD64 && buf[0] == 0x48 && buf[1] == 0xA1)
{
// for x64 the code here is:
// 48 A1 00 40 40 00 00 00 00 00 mov rax,qword ptr [0000000000404000h]
// FF E0 jmp rax
offset = 2;
}
else if (machine == ImageFileMachine.ARM && buf[0] == 0xDF && buf[1] == 0xF8 && buf[2] == 0x08 && buf[3] == 0xC0)
{
// for arm the code here is:
// F8DF C008 ldr r12,0040145C
// F8DC C000 ldr r12,[r12]
// 4760 bx r12
// DEFE __debugbreak
// here is the RVA
offset = 12;
}
else
{
return -1;
}
int vtableRVA = BitConverter.ToInt32(buf, offset) - (int)module.__ImageBase;
module.__ReadDataFromRVA(vtableRVA, buf, 0, 4);
return BitConverter.ToInt32(buf, 0);
}
