Walk and parse the import directory.
(self, rva, size, dllnames_only=False)
| 5374 | return md5(",".join(impstrs).encode()).hexdigest() |
| 5375 | |
| 5376 | def parse_import_directory(self, rva, size, dllnames_only=False): |
| 5377 | """Walk and parse the import directory.""" |
| 5378 | |
| 5379 | import_descs = [] |
| 5380 | error_count = 0 |
| 5381 | image_import_descriptor_size = Structure( |
| 5382 | self.__IMAGE_IMPORT_DESCRIPTOR_format__ |
| 5383 | ).sizeof() |
| 5384 | while True: |
| 5385 | try: |
| 5386 | # If the RVA is invalid all would blow up. Some EXEs seem to be |
| 5387 | # specially nasty and have an invalid RVA. |
| 5388 | data = self.get_data(rva, image_import_descriptor_size) |
| 5389 | except PEFormatError: |
| 5390 | self.__warnings.append( |
| 5391 | f"Error parsing the import directory at RVA: 0x{rva:x}" |
| 5392 | ) |
| 5393 | break |
| 5394 | |
| 5395 | file_offset = self.get_offset_from_rva(rva) |
| 5396 | import_desc = self.__unpack_data__( |
| 5397 | self.__IMAGE_IMPORT_DESCRIPTOR_format__, data, file_offset=file_offset |
| 5398 | ) |
| 5399 | |
| 5400 | # If the structure is all zeros, we reached the end of the list |
| 5401 | if not import_desc or import_desc.all_zeroes(): |
| 5402 | break |
| 5403 | |
| 5404 | rva += import_desc.sizeof() |
| 5405 | |
| 5406 | # If the array of thunks is somewhere earlier than the import |
| 5407 | # descriptor we can set a maximum length for the array. Otherwise |
| 5408 | # just set a maximum length of the size of the file |
| 5409 | max_len = len(self.__data__) - file_offset |
| 5410 | if rva > import_desc.OriginalFirstThunk or rva > import_desc.FirstThunk: |
| 5411 | max_len = max( |
| 5412 | rva - import_desc.OriginalFirstThunk, rva - import_desc.FirstThunk |
| 5413 | ) |
| 5414 | |
| 5415 | import_data = [] |
| 5416 | if not dllnames_only: |
| 5417 | try: |
| 5418 | import_data = self.parse_imports( |
| 5419 | import_desc.OriginalFirstThunk, |
| 5420 | import_desc.FirstThunk, |
| 5421 | import_desc.ForwarderChain, |
| 5422 | max_length=max_len, |
| 5423 | ) |
| 5424 | except PEFormatError as e: |
| 5425 | self.__warnings.append( |
| 5426 | "Error parsing the import directory. " |
| 5427 | f"Invalid Import data at RVA: 0x{rva:x} ({e.value})" |
| 5428 | ) |
| 5429 | |
| 5430 | if error_count > 5: |
| 5431 | self.__warnings.append( |
| 5432 | "Too many errors parsing the import directory. " |
| 5433 | f"Invalid import data at RVA: 0x{rva:x}" |
nothing calls this directly
no test coverage detected