bdpayne/libvmi — pull request #42 by tklengyel (2013-04-04 17:54:33+00:00)
Title: RFC: Windows usym2v

Peparse currently implements translating symbols in the export table to RVA only for the kernel. This can be easily adopted to translate any symbol in a PE export table, provided the base_vaddr and pid where the PE header can be accessed.

TODO: Linux
TODO: symcache. Currently the symbol's name is used as the key into a GHashTable, which might be problematic if we have multiple modules exported symbols with the same name. We could implement a two-level hierarchy for the cache, where the first GHashTable's key is the base_vaddr and it's value is the GHashTable that currently holds the symbol RVA's.