parameters: (self, rva, size)
return_statement: return ExportDirData(
                  struct = export_dir,
                  symbols = exports)
docstring: Parse the export directory.
          
          Given the rva of the export directory, it will process all
          its entries.
          
          The exports will be made available through a list "exports"
          containing a tuple with the following elements:
          
              (ordinal, symbol_address, symbol_name)
              
          And also through a dicionary "exports_by_ordinal" whose keys
          will be the ordinals and the values tuples of the from:
          
              (symbol_address, symbol_name)
              
          The symbol addresses are relative, not absolute.
docstring_summary: Parse the export directory.
          
          Given the rva of the export directory, it will process all
          its entries.
          
          The exports will be made available through a list "exports"
          containing a tuple with the following elements:
          
              (ordinal, symbol_address, symbol_name)
              
          And also through a dicionary "exports_by_ordinal" whose keys
          will be the ordinals and the values tuples of the from:
          
              (symbol_address, symbol_name)
              
          The symbol addresses are relative, not absolute.
docstring_tokens: Parse the export directory . Given the rva of the export directory it will process all its entries . The exports will be made available through a list exports containing a tuple with the following elements : ( ordinal symbol_address symbol_name ) And also through a dicionary exports_by_ordinal whose keys will be the ordinals and the values tuples of the from : ( symbol_address symbol_name ) The symbol addresses are relative not absolute .
function: def parse_export_directory(self, rva, size):
          """Parse the export directory.
          
          Given the rva of the export directory, it will process all
          its entries.
          
          The exports will be made available through a list "exports"
          containing a tuple with the following elements:
          
              (ordinal, symbol_address, symbol_name)
              
          And also through a dicionary "exports_by_ordinal" whose keys
          will be the ordinals and the values tuples of the from:
          
              (symbol_address, symbol_name)
              
          The symbol addresses are relative, not absolute.
          """
      
          try:
              export_dir =  self.__unpack_data__(
                  self.__IMAGE_EXPORT_DIRECTORY_format__, self.get_data(rva),
                  file_offset = self.get_offset_from_rva(rva) )
          except PEFormatError:
              self.__warnings.append(
                  'Error parsing export directory at RVA: 0x%x' % ( rva ) )
              return
          
          if not export_dir:
              return
          
          try:
              address_of_names = self.get_data(
                  export_dir.AddressOfNames, export_dir.NumberOfNames*4)
              address_of_name_ordinals = self.get_data(
                  export_dir.AddressOfNameOrdinals, export_dir.NumberOfNames*4)
              address_of_functions = self.get_data(
                  export_dir.AddressOfFunctions, export_dir.NumberOfFunctions*4)
          except PEFormatError:
              self.__warnings.append(
                  'Error parsing export directory at RVA: 0x%x' % ( rva ) )
              return
              
          exports = []
          
          for i in xrange(export_dir.NumberOfNames):
          
                  
              symbol_name = self.get_string_at_rva(
                  self.get_dword_from_data(address_of_names, i))
              
              symbol_ordinal = self.get_word_from_data(
                  address_of_name_ordinals, i)
                  
              
              if symbol_ordinal*4<len(address_of_functions):
                  symbol_address = self.get_dword_from_data(
                      address_of_functions, symbol_ordinal)
              else:
                  # Corrupt? a bad pointer... we assume it's all
                  # useless, no exports
                  return None
              
              # If the funcion's rva points within the export directory
              # it will point to a string with the forwarded symbol's string
              # instead of pointing the the function start address.
              
              if symbol_address>=rva and symbol_address<rva+size:
                  forwarder_str = self.get_string_at_rva(symbol_address)
              else:
                  forwarder_str = None
          
              
              exports.append(
                  ExportData(
                      ordinal = export_dir.Base+symbol_ordinal,
                      address = symbol_address,
                      name = symbol_name,
                      forwarder = forwarder_str))
                      
          ordinals = [exp.ordinal for exp in exports]
          
          for idx in xrange(export_dir.NumberOfFunctions):
  
              if not idx+export_dir.Base in ordinals:
                  symbol_address = self.get_dword_from_data(
                      address_of_functions, 
                      idx)
                  
                  #
                  # Checking for forwarder again.
                  #
                  if symbol_address>=rva and symbol_address<rva+size:
                      forwarder_str = self.get_string_at_rva(symbol_address)
                  else:
                      forwarder_str = None
                      
                  exports.append(
                      ExportData(
                          ordinal = export_dir.Base+idx,
                          address = symbol_address,
                          name = None,
                          forwarder = forwarder_str))
                        
          return ExportDirData(
                  struct = export_dir,
                  symbols = exports)
function_tokens: def parse_export_directory ( self , rva , size ) : try : export_dir = self . __unpack_data__ ( self . __IMAGE_EXPORT_DIRECTORY_format__ , self . get_data ( rva ) , file_offset = self . get_offset_from_rva ( rva ) ) except PEFormatError : self . __warnings . append ( 'Error parsing export directory at RVA: 0x%x' % ( rva ) ) return if not export_dir : return try : address_of_names = self . get_data ( export_dir . AddressOfNames , export_dir . NumberOfNames * 4 ) address_of_name_ordinals = self . get_data ( export_dir . AddressOfNameOrdinals , export_dir . NumberOfNames * 4 ) address_of_functions = self . get_data ( export_dir . AddressOfFunctions , export_dir . NumberOfFunctions * 4 ) except PEFormatError : self . __warnings . append ( 'Error parsing export directory at RVA: 0x%x' % ( rva ) ) return exports = [ ] for i in xrange ( export_dir . NumberOfNames ) : symbol_name = self . get_string_at_rva ( self . get_dword_from_data ( address_of_names , i ) ) symbol_ordinal = self . get_word_from_data ( address_of_name_ordinals , i ) if symbol_ordinal * 4 < len ( address_of_functions ) : symbol_address = self . get_dword_from_data ( address_of_functions , symbol_ordinal ) else : # Corrupt? a bad pointer... we assume it's all # useless, no exports return None # If the funcion's rva points within the export directory # it will point to a string with the forwarded symbol's string # instead of pointing the the function start address. if symbol_address >= rva and symbol_address < rva + size : forwarder_str = self . get_string_at_rva ( symbol_address ) else : forwarder_str = None exports . append ( ExportData ( ordinal = export_dir . Base + symbol_ordinal , address = symbol_address , name = symbol_name , forwarder = forwarder_str ) ) ordinals = [ exp . ordinal for exp in exports ] for idx in xrange ( export_dir . NumberOfFunctions ) : if not idx + export_dir . Base in ordinals : symbol_address = self . get_dword_from_data ( address_of_functions , idx ) # # Checking for forwarder again. # if symbol_address >= rva and symbol_address < rva + size : forwarder_str = self . get_string_at_rva ( symbol_address ) else : forwarder_str = None exports . append ( ExportData ( ordinal = export_dir . Base + idx , address = symbol_address , name = None , forwarder = forwarder_str ) ) return ExportDirData ( struct = export_dir , symbols = exports )