Package ghidra.app.util.bin.format.pe

Class DelayImportDescriptor

java.lang.Object

ghidra.app.util.bin.format.pe.DelayImportDescriptor

All Implemented Interfaces:

StructConverter

public class DelayImportDescriptor
extends java.lang.Object
implements StructConverter

A class to represent the ImgDelayDescr data structure defined in DELAYIMP.H.

 typedef struct ImgDelayDescr {
     DWORD           grAttrs;        // attributes
     LPCSTR          szName;         // pointer to dll name
     HMODULE *       phmod;          // address of module handle
     PImgThunkData   pIAT;           // address of the IAT
     PCImgThunkData  pINT;           // address of the INT
     PCImgThunkData  pBoundIAT;      // address of the optional bound IAT
     PCImgThunkData  pUnloadIAT;     // address of optional copy of original IAT
     DWORD           dwTimeStamp;    // 0 if not bound,
                                     // O.W. date/time stamp of DLL bound to (old BIND)
 } ImgDelayDescr, * PImgDelayDescr;
 

Field Summary

Fields

Modifier and Type	Field	Description
static java.lang.String	NAME

Fields inherited from interface ghidra.app.util.bin.StructConverter

ASCII, BYTE, DWORD, IBO32, POINTER, QWORD, STRING, UTF16, UTF8, VOID, WORD

Constructor Summary

Constructors

Constructor	Description
DelayImportDescriptor()	DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.

Method Summary

Modifier and Type	Method	Description
long	getAddressOfBoundIAT()	Returns the address of the optional bound IAT.
long	getAddressOfIAT()	Returns the address of the import address table.
long	getAddressOfINT()	Returns the address of the import name table.
long	getAddressOfModuleHandle()	Returns the address of the module handle.
long	getAddressOfOriginalIAT()	Returns the address of the optional copy of original IAT.
int	getAttibutes()	Returns the attributes.
java.lang.String	getDLLName()	Returns the DLL name.
java.util.Map<ThunkData,ImportByName>	getImportByNameMap()
java.util.List<DelayImportInfo>	getImportList()
long	getPointerToDLLName()	Returns the pointer to the DLL name.
java.util.List<ThunkData>	getThunksBoundIAT()
java.util.List<ThunkData>	getThunksIAT()
java.util.List<ThunkData>	getThunksINT()
java.util.List<ThunkData>	getThunksUnloadIAT()
int	getTimeStamp()	Returns the date/time stamp of DLL bound to (Old BIND), otherwise 0 if not bound.
boolean	isUsingRVA()	Returns true if the "using relative virtual address" is flag is set
boolean	isValid()
int	sizeof()	Returns the size of this structure.
DataType	toDataType()	Returns a structure datatype representing the contents of the implementor of this interface.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

NAME

public static final java.lang.String NAME

See Also:

Constant Field Values

Constructor Detail

DelayImportDescriptor

public DelayImportDescriptor()

DO NOT USE THIS CONSTRUCTOR, USE create*(GenericFactory ...) FACTORY METHODS INSTEAD.

Method Detail

isUsingRVA

public boolean isUsingRVA()

Returns true if the "using relative virtual address" is flag is set

Returns:

true if the "using relative virtual address" is flag is set

getAttibutes

public int getAttibutes()

Returns the attributes.

Returns:

the attributes

getPointerToDLLName

public long getPointerToDLLName()

Returns the pointer to the DLL name.

Returns:

the pointer to the DLL name

getAddressOfModuleHandle

public long getAddressOfModuleHandle()

Returns the address of the module handle.

Returns:

the address of the module handle

getAddressOfIAT

public long getAddressOfIAT()

Returns the address of the import address table.

Returns:

the address of the import address table

getAddressOfINT

public long getAddressOfINT()

Returns the address of the import name table.

Returns:

the address of the import name table

getAddressOfBoundIAT

public long getAddressOfBoundIAT()

Returns the address of the optional bound IAT.

Returns:

the address of the optional bound IAT

getAddressOfOriginalIAT

public long getAddressOfOriginalIAT()

Returns the address of the optional copy of original IAT.

Returns:

the address of the optional copy of original IAT

getTimeStamp

public int getTimeStamp()

Returns the date/time stamp of DLL bound to (Old BIND), otherwise 0 if not bound.

Returns:

if bound returns the time stamp, otherwise 0

getDLLName

public java.lang.String getDLLName()

Returns the DLL name.

Returns:

the DLL name

getImportByNameMap

public java.util.Map<ThunkData,ImportByName> getImportByNameMap()

getImportList

public java.util.List<DelayImportInfo> getImportList()

getThunksIAT

public java.util.List<ThunkData> getThunksIAT()

getThunksINT

public java.util.List<ThunkData> getThunksINT()

getThunksBoundIAT

public java.util.List<ThunkData> getThunksBoundIAT()

getThunksUnloadIAT

public java.util.List<ThunkData> getThunksUnloadIAT()

toDataType

public DataType toDataType()
                    throws DuplicateNameException,
                           java.io.IOException

Description copied from interface: StructConverter

Returns a structure datatype representing the contents of the implementor of this interface.

For example, given:

 class A {
     int foo;
     double bar;
 }
 

The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

Specified by:

toDataType in interface StructConverter

Returns:

returns a structure datatype representing the implementor of this interface

Throws:

DuplicateNameException - when a datatype of the same name already exists

java.io.IOException

See Also:

StructureDataType

sizeof

public int sizeof()

Returns the size of this structure. It accounts for 32 vs 64 bit.

Returns:

the size of this structure

isValid

public boolean isValid()