Walk and parse the delay import directory.
(self, rva, size)
| 5212 | return va |
| 5213 | |
| 5214 | def parse_delay_import_directory(self, rva, size): |
| 5215 | """Walk and parse the delay import directory.""" |
| 5216 | |
| 5217 | import_descs = [] |
| 5218 | error_count = 0 |
| 5219 | while True: |
| 5220 | try: |
| 5221 | # If the RVA is invalid all would blow up. Some PEs seem to be |
| 5222 | # specially nasty and have an invalid RVA. |
| 5223 | data = self.get_data( |
| 5224 | rva, |
| 5225 | Structure(self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__).sizeof(), |
| 5226 | ) |
| 5227 | except PEFormatError: |
| 5228 | self.__warnings.append( |
| 5229 | "Error parsing the Delay import directory at RVA: 0x%x" % (rva) |
| 5230 | ) |
| 5231 | break |
| 5232 | |
| 5233 | file_offset = self.get_offset_from_rva(rva) |
| 5234 | import_desc = self.__unpack_data__( |
| 5235 | self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__, |
| 5236 | data, |
| 5237 | file_offset=file_offset, |
| 5238 | ) |
| 5239 | |
| 5240 | # If the structure is all zeros, we reached the end of the list |
| 5241 | if not import_desc or import_desc.all_zeroes(): |
| 5242 | break |
| 5243 | contains_addresses = False |
| 5244 | |
| 5245 | # Handle old import descriptor that has Virtual Addresses instead of RVAs |
| 5246 | # This version of import descriptor is created by old Visual Studio versions |
| 5247 | # (pre 6.0) |
| 5248 | # Can only be present in 32-bit binaries (no 64-bit compiler existed at the |
| 5249 | # time) |
| 5250 | # Sample: e8d3bff0c1a9a6955993f7a441121a2692261421e82fdfadaaded45d3bea9980 |
| 5251 | if ( |
| 5252 | import_desc.grAttrs == 0 |
| 5253 | and self.FILE_HEADER.Machine == MACHINE_TYPE["IMAGE_FILE_MACHINE_I386"] |
| 5254 | ): |
| 5255 | import_desc.pBoundIAT = self.normalize_import_va(import_desc.pBoundIAT) |
| 5256 | import_desc.pIAT = self.normalize_import_va(import_desc.pIAT) |
| 5257 | import_desc.pINT = self.normalize_import_va(import_desc.pINT) |
| 5258 | import_desc.pUnloadIAT = self.normalize_import_va( |
| 5259 | import_desc.pUnloadIAT |
| 5260 | ) |
| 5261 | import_desc.phmod = self.normalize_import_va(import_desc.pUnloadIAT) |
| 5262 | import_desc.szName = self.normalize_import_va(import_desc.szName) |
| 5263 | contains_addresses = True |
| 5264 | |
| 5265 | rva += import_desc.sizeof() |
| 5266 | |
| 5267 | # If the array of thunks is somewhere earlier than the import |
| 5268 | # descriptor we can set a maximum length for the array. Otherwise |
| 5269 | # just set a maximum length of the size of the file |
| 5270 | max_len = len(self.__data__) - file_offset |
| 5271 | if rva > import_desc.pINT or rva > import_desc.pIAT: |
nothing calls this directly
no test coverage detected