unknownv2 / CoreHook

A library that simplifies intercepting application function calls using managed code and the .NET Core runtime
MIT License
259 stars 40 forks source link

Update Windows PE header parsing #118

Closed unknownv2 closed 5 years ago

unknownv2 commented 5 years ago

Implement new PE header parsing code used to read the export directory entries to get a function's address using it's name for a remote process.

This method uses structures so the parsing code is clearer instead of seeking to random offsets and reading data, skipping around with a stream.

This will hopefully improve code readability.