Class DelayImportDescriptor

java.lang.Object
ghidra.app.util.bin.format.pe.DelayImportDescriptor
All Implemented Interfaces:
StructConverter

public class DelayImportDescriptor extends Object implements StructConverter
A class to represent the ImgDelayDescr data structure defined in DELAYIMP.H.

 typedef struct ImgDelayDescr {
     DWORD           grAttrs;        // attributes
     LPCSTR          szName;         // pointer to dll name
     HMODULE *       phmod;          // address of module handle
     PImgThunkData   pIAT;           // address of the IAT
     PCImgThunkData  pINT;           // address of the INT
     PCImgThunkData  pBoundIAT;      // address of the optional bound IAT
     PCImgThunkData  pUnloadIAT;     // address of optional copy of original IAT
     DWORD           dwTimeStamp;    // 0 if not bound,
                                     // O.W. date/time stamp of DLL bound to (old BIND)
 } ImgDelayDescr, * PImgDelayDescr;
 
  • Field Details

  • Method Details

    • isUsingRVA

      public boolean isUsingRVA()
      Returns true if the "using relative virtual address" is flag is set
      Returns:
      true if the "using relative virtual address" is flag is set
    • getAttibutes

      public int getAttibutes()
      Returns the attributes.
      Returns:
      the attributes
    • getPointerToDLLName

      public long getPointerToDLLName()
      Returns the pointer to the DLL name.
      Returns:
      the pointer to the DLL name
    • getAddressOfModuleHandle

      public long getAddressOfModuleHandle()
      Returns the address of the module handle.
      Returns:
      the address of the module handle
    • getAddressOfIAT

      public long getAddressOfIAT()
      Returns the address of the import address table.
      Returns:
      the address of the import address table
    • getAddressOfINT

      public long getAddressOfINT()
      Returns the address of the import name table.
      Returns:
      the address of the import name table
    • getAddressOfBoundIAT

      public long getAddressOfBoundIAT()
      Returns the address of the optional bound IAT.
      Returns:
      the address of the optional bound IAT
    • getAddressOfOriginalIAT

      public long getAddressOfOriginalIAT()
      Returns the address of the optional copy of original IAT.
      Returns:
      the address of the optional copy of original IAT
    • getTimeStamp

      public int getTimeStamp()
      Returns the date/time stamp of DLL bound to (Old BIND), otherwise 0 if not bound.
      Returns:
      if bound returns the time stamp, otherwise 0
    • getDLLName

      public String getDLLName()
      Returns the DLL name.
      Returns:
      the DLL name
    • getImportByNameMap

      public Map<ThunkData,ImportByName> getImportByNameMap()
    • getImportList

      public List<ImportInfo> getImportList()
    • getThunksIAT

      public List<ThunkData> getThunksIAT()
    • getThunksINT

      public List<ThunkData> getThunksINT()
    • getThunksBoundIAT

      public List<ThunkData> getThunksBoundIAT()
    • getThunksUnloadIAT

      public List<ThunkData> getThunksUnloadIAT()
    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given:

       class A {
           int foo;
           double bar;
       }
       

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException - if an IO-related error occurs
      See Also:
    • sizeof

      public int sizeof()
      Returns the size of this structure. It accounts for 32 vs 64 bit.
      Returns:
      the size of this structure
    • isValid

      public boolean isValid()