Parse the imported symbols. It will fill a list, which will be available as the dictionary attribute "imports". Its keys will be the DLL names and the values of all the symbols imported from that object.
(
self,
original_first_thunk,
first_thunk,
forwarder_chain,
max_length=None,
contains_addresses=False,
)
| 5480 | return import_descs |
| 5481 | |
| 5482 | def parse_imports( |
| 5483 | self, |
| 5484 | original_first_thunk, |
| 5485 | first_thunk, |
| 5486 | forwarder_chain, |
| 5487 | max_length=None, |
| 5488 | contains_addresses=False, |
| 5489 | ): |
| 5490 | """Parse the imported symbols. |
| 5491 | |
| 5492 | It will fill a list, which will be available as the dictionary |
| 5493 | attribute "imports". Its keys will be the DLL names and the values |
| 5494 | of all the symbols imported from that object. |
| 5495 | """ |
| 5496 | |
| 5497 | imported_symbols = [] |
| 5498 | |
| 5499 | # Import Lookup Table. Contains ordinals or pointers to strings. |
| 5500 | ilt = self.get_import_table( |
| 5501 | original_first_thunk, max_length, contains_addresses |
| 5502 | ) |
| 5503 | # Import Address Table. May have identical content to ILT if |
| 5504 | # PE file is not bound. It will contain the address of the |
| 5505 | # imported symbols once the binary is loaded or if it is already |
| 5506 | # bound. |
| 5507 | iat = self.get_import_table(first_thunk, max_length, contains_addresses) |
| 5508 | |
| 5509 | # OC Patch: |
| 5510 | # Would crash if IAT or ILT had None type |
| 5511 | if (not iat or len(iat) == 0) and (not ilt or len(ilt) == 0): |
| 5512 | self.__warnings.append( |
| 5513 | "Damaged Import Table information. " |
| 5514 | "ILT and/or IAT appear to be broken. " |
| 5515 | f"OriginalFirstThunk: 0x{original_first_thunk:x} " |
| 5516 | f"FirstThunk: 0x{first_thunk:x}" |
| 5517 | ) |
| 5518 | return [] |
| 5519 | |
| 5520 | table = None |
| 5521 | if ilt: |
| 5522 | table = ilt |
| 5523 | elif iat: |
| 5524 | table = iat |
| 5525 | else: |
| 5526 | return None |
| 5527 | |
| 5528 | imp_offset = 4 |
| 5529 | address_mask = 0x7FFFFFFF |
| 5530 | if self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE: |
| 5531 | ordinal_flag = IMAGE_ORDINAL_FLAG |
| 5532 | elif self.PE_TYPE == OPTIONAL_HEADER_MAGIC_PE_PLUS: |
| 5533 | ordinal_flag = IMAGE_ORDINAL_FLAG64 |
| 5534 | imp_offset = 8 |
| 5535 | address_mask = 0x7FFFFFFFFFFFFFFF |
| 5536 | else: |
| 5537 | # Some PEs may have an invalid value in the Magic field of the |
| 5538 | # Optional Header. Just in case the remaining file is parseable |
| 5539 | # let's pretend it's a 32bit PE32 by default. |
no test coverage detected