# ImplMap

The ImplMap table contains various information about unmanaged functions statically imported via P/Invoke.

ImplMap.get_unmanaged_functions() -> List[str]

Get a list of unmanaged function names as is. We ignore the CharSet field values in the table rows and don't make any assumptions on it (...A/W function or no charset).

We made some tests to understand how this field is filled by the Visual C# compiler with the following results:

• For ANSI only functions, it doesn't matter what CharSet value you set in the C# definition. You can even use Unicode and it still works.
• ANSI only functions can't be "name" defined, meaning you can't use GetProcAddressA as function name no matter what you set in CharSet.

As a result, we have to ignore the CharSet field as it's not a reliable value for the function charset determination. It's not possible to determine if a function is an ANSI only one based on the field value. It's only possible to determine for Unicode functions (...W), but having only this possibility is inconsistent.

Parameters:

-

Return value:

A list with unmanaged function names

Example:

# Import class DotNetPE from module dotnetfile
from dotnetfile import DotNetPE

# Create an instance of DotNetPE with the file path as a parameter
dotnet_file = DotNetPE('/Users/<username>/my_dotnet_assembly.exe')

# Check if the "ImplMap" table exists
if dotnet_file.metadata_table_exists('ImplMap'):
    # Get list with unmanaged functions names with character set appendix
    unmanaged_functions = dotnet_file.ImplMap.get_unmanaged_functions()

    # Print out the function names
    for unmanaged_function in unmanaged_functions:
        print(f'{unmanaged_function}')