From bc572f5d3311dc7520920cbc003aaceda0fc35b3 Mon Sep 17 00:00:00 2001 From: bird_egop Date: Sat, 12 Apr 2025 16:51:22 +0300 Subject: [PATCH] Fix DLL name parsing in export directory to properly separate DLL name from function names --- X86Disassembler/PEFormat.cs | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/X86Disassembler/PEFormat.cs b/X86Disassembler/PEFormat.cs index 7b82e75..7cc98e5 100644 --- a/X86Disassembler/PEFormat.cs +++ b/X86Disassembler/PEFormat.cs @@ -318,10 +318,27 @@ namespace X86Disassembler directory.AddressOfNameOrdinals = reader.ReadUInt32(); // Read the DLL name - uint dllNameRVA = directory.Name; - reader.BaseStream.Seek(RvaToOffset(dllNameRVA), SeekOrigin.Begin); - byte[] dllNameBytes = reader.ReadBytes(256); - directory.DllName = Encoding.ASCII.GetString(dllNameBytes).TrimEnd('\0'); + try + { + uint dllNameRVA = directory.Name; + uint dllNameOffset = RvaToOffset(dllNameRVA); + reader.BaseStream.Seek(dllNameOffset, SeekOrigin.Begin); + + // Read the null-terminated ASCII string + StringBuilder nameBuilder = new StringBuilder(); + byte b; + + while ((b = reader.ReadByte()) != 0) + { + nameBuilder.Append((char)b); + } + + directory.DllName = nameBuilder.ToString(); + } + catch (Exception) + { + directory.DllName = "Unknown"; + } return directory; }