search

m4b / goblin

An impish, cross-platform binary parsing crate, written in Rust
MIT License
1.17k stars 156 forks source link

[ Quesion ] Delay Load Imports #343

Open dfirence opened 1 year ago

dfirence commented 1 year ago

Does Goblin obtain the "Delay Loaded" imports from "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT"?

I see in the source: https://docs.rs/goblin/latest/goblin/pe/data_directories/struct.DataDirectories.html#method.get_delay_import_descriptor

I assume that when the IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT is present in the PE File then the developer should invoke the goblin get_delay_import_descriptor() on the file, and these would be obtained.

Am i assuming correctly?

dfirence commented 1 year ago

@m4b An7 chance you can answer this one, please?

m4b commented 1 year ago

Seems correct yes. Since it returns an optional if it is present then it’ll be Some.

if you’re asking whether a “delay loaded” import is described by this descriptor I assume so though I’m not super familiar with this.

is the struct returned from this function call not giving you the information you need for some task related to delay loaded imports?