@@ -109,6 +109,8 @@ about symbols, etc::
109109 WORD Characteristics;
110110 } IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
111111
112+ .. _OptionalHeader:
113+
112114The `OptionalHeader` contains informations about the *logical* format of the library,
113115including required OS version, memory requirements and entry points::
114116
@@ -155,6 +157,8 @@ including required OS version, memory requirements and entry points::
155157 IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
156158 } IMAGE_OPTIONAL_HEADER32, *PIMAGE_OPTIONAL_HEADER32;
157159
160+ .. _DataDirectory:
161+
158162The `DataDirectory` contains 16 (`IMAGE_NUMBEROF_DIRECTORY_ENTRIES`) entries
159163defining the logical components of the library:
160164
@@ -200,7 +204,7 @@ the exports entry is required.
200204Section header
201205---------------
202206
203- The section header is stored after the `OptionalHeader` structure in the PE
207+ The section header is stored after the OptionalHeader_ structure in the PE
204208header. Microsoft provides the macro `IMAGE_FIRST_SECTION` to get the start
205209address based on the PE header.
206210
@@ -273,7 +277,7 @@ All memory required for the library must be reserved / allocated using
273277This is required to restrict access to the memory, like blocking write access
274278to the code or constant data.
275279
276- The `OptionalHeader` structure defines the size of the required memory block
280+ The OptionalHeader_ structure defines the size of the required memory block
277281for the library. It must be reserved at the address specified by `ImageBase`
278282if possible::
279283
@@ -302,7 +306,7 @@ Before copying the data, the memory block must get committed::
302306
303307Sections without data in the file (like data sections for the used variables)
304308have a `SizeOfRawData` of `0`, so you can use the `SizeOfInitializedData`
305- or `SizeOfUninitializedData` of the `OptionalHeader` . Which one must get
309+ or `SizeOfUninitializedData` of the OptionalHeader_ . Which one must get
306310choosen depending on the bit flags `IMAGE_SCN_CNT_INITIALIZED_DATA` and
307311`IMAGE_SCN_CNT_UNINITIALIZED_DATA` that may be set in the section`s
308312characteristics.
@@ -312,13 +316,14 @@ Base relocation
312316----------------
313317
314318All memory addresses in the code / data sections of a library are stored relative
315- to the address defined by `ImageBase` in the `OptionalHeader` . If the library
319+ to the address defined by `ImageBase` in the OptionalHeader_ . If the library
316320can't be imported to this memory address, the references must get adjusted
317321=> *relocated*. The file format helps for this by storing informations about
318322all these references in the base relocation table, which can be found in the
319- directory entry 5 of the `DataDirectory` in the `OptionalHeader` .
323+ directory entry 5 of the DataDirectory_ in the OptionalHeader_ .
320324
321325This table consists of a series of this structure
326+
322327::
323328
324329 typedef struct _IMAGE_BASE_RELOCATION {
@@ -342,7 +347,7 @@ IMAGE_REL_BASED_HIGHLOW
342347Resolve imports
343348----------------
344349
345- The directory entry 0 of the `DataDirectory` in the `OptionalHeader` specifies
350+ The directory entry 1 of the DataDirectory_ in the OptionalHeader_ specifies
346351a list of libraries to import symbols from. Each entry in this list is defined
347352as follows::
348353
@@ -452,7 +457,32 @@ Afterwards we can use the exported functions as with any normal library.
452457Exported functions
453458===================
454459
455- TODO
460+ If you want to access the functions that are exported by the library, you need to find the entry
461+ point to a symbol, i.e. the name of the function to call.
462+
463+ The directory entry 0 of the DataDirectory_ in the OptionalHeader_ contains informations about
464+ the exported functions. It's defined as follows::
465+
466+ typedef struct _IMAGE_EXPORT_DIRECTORY {
467+ DWORD Characteristics;
468+ DWORD TimeDateStamp;
469+ WORD MajorVersion;
470+ WORD MinorVersion;
471+ DWORD Name;
472+ DWORD Base;
473+ DWORD NumberOfFunctions;
474+ DWORD NumberOfNames;
475+ DWORD AddressOfFunctions; // RVA from base of image
476+ DWORD AddressOfNames; // RVA from base of image
477+ DWORD AddressOfNameOrdinals; // RVA from base of image
478+ } IMAGE_EXPORT_DIRECTORY, *PIMAGE_EXPORT_DIRECTORY;
479+
480+ First thing to do, is to map the name of the function to the ordinal number of the exported
481+ symbol. Therefore, just walk the arrays defined by `AddressOfNames` and `AddressOfNameOrdinals`
482+ parallel until you found the required name.
483+
484+ Now you can use the ordinal number to read the address by evaluating the n-th element of the
485+ `AddressOfFunctions` array.
456486
457487
458488Freeing the library
@@ -478,17 +508,23 @@ The interface is very similar to the standard methods for loading of libraries::
478508
479509 typedef void *HMEMORYMODULE;
480510
481- HMEMORYMODULE MemoryLoadLibrary(const void *, const size_t );
511+ HMEMORYMODULE MemoryLoadLibrary(const void *);
482512 FARPROC MemoryGetProcAddress(HMEMORYMODULE, const char *);
483513 void MemoryFreeLibrary(HMEMORYMODULE);
484514
485515
486516Downloads
487517----------
488518
489- Currently, MemoryModule is only available from my SVN server at
519+ The latest development release can always be grabbed from my development SVN-Server at
490520https://leviathan.joachim-bauch.de/cgi-bin/viewcvs.cgi/MemoryModule/trunk/?root=misc
491521
522+ Please note that it's located in my room so it doesn't run 24/7 and is often offline during
523+ nights or on weekends. If you encounter problems connecting, please try again some other
524+ time of day.
525+
526+ All released versions can be downloaded from the list below.
527+
492528
493529Known issues
494530-------------
0 commit comments