Package ghidra.app.util.bin.format.pe

Class DelayImportDescriptor

java.lang.Object
ghidra.app.util.bin.format.pe.DelayImportDescriptor
All Implemented Interfaces:
StructConverter
public class DelayImportDescriptor extends Object implements StructConverter
A class to represent the ImgDelayDescr data structure defined in DELAYIMP.H. 

 typedef struct ImgDelayDescr {
     DWORD           grAttrs;        // attributes
     LPCSTR          szName;         // pointer to dll name
     HMODULE *       phmod;          // address of module handle
     PImgThunkData   pIAT;           // address of the IAT
     PCImgThunkData  pINT;           // address of the INT
     PCImgThunkData  pBoundIAT;      // address of the optional bound IAT
     PCImgThunkData  pUnloadIAT;     // address of optional copy of original IAT
     DWORD           dwTimeStamp;    // 0 if not bound,
                                     // O.W. date/time stamp of DLL bound to (old BIND)
 } ImgDelayDescr, * PImgDelayDescr;

  • Field Details

  • Method Details

    • isUsingRVA

      public boolean isUsingRVA()
      Returns true if the "using relative virtual address" is flag is set
      Returns:
      true if the "using relative virtual address" is flag is set

    • getAttibutes

      public int getAttibutes()
      Returns the attributes.
      Returns:
      the attributes

    • getPointerToDLLName

      public long getPointerToDLLName()
      Returns the pointer to the DLL name.
      Returns:
      the pointer to the DLL name

    • getAddressOfModuleHandle

      public long getAddressOfModuleHandle()
      Returns the address of the module handle.
      Returns:
      the address of the module handle

    • getAddressOfIAT

      public long getAddressOfIAT()
      Returns the address of the import address table.
      Returns:
      the address of the import address table

    • getAddressOfINT

      public long getAddressOfINT()
      Returns the address of the import name table.
      Returns:
      the address of the import name table

    • getAddressOfBoundIAT

      public long getAddressOfBoundIAT()
      Returns the address of the optional bound IAT.
      Returns:
      the address of the optional bound IAT

    • getAddressOfOriginalIAT

      public long getAddressOfOriginalIAT()
      Returns the address of the optional copy of original IAT.
      Returns:
      the address of the optional copy of original IAT

    • getTimeStamp

      public int getTimeStamp()
      Returns the date/time stamp of DLL bound to (Old BIND), otherwise 0 if not bound.
      Returns:
      if bound returns the time stamp, otherwise 0

    • getDLLName

      public String getDLLName()
      Returns the DLL name.
      Returns:
      the DLL name

    • getImportByNameMap

      public Map<ThunkData,ImportByName> getImportByNameMap()

    • getImportList

      public List<ImportInfo> getImportList()

    • getThunksIAT

      public List<ThunkData> getThunksIAT()

    • getThunksINT

      public List<ThunkData> getThunksINT()

    • getThunksBoundIAT

      public List<ThunkData> getThunksBoundIAT()

    • getThunksUnloadIAT

      public List<ThunkData> getThunksUnloadIAT()

    • toDataType

      public DataType toDataType() throws DuplicateNameException, IOException
      Description copied from interface: StructConverter
      Returns a structure datatype representing the contents of the implementor of this interface.

      For example, given: 

       class A {
     int foo;
     double bar;
 }

      The return value should be a structure data type with two data type components; an INT and a DOUBLE. The structure should contain field names and, if possible, field comments.

      Specified by:
      toDataType in interface StructConverter
      Returns:
      returns a structure datatype representing the implementor of this interface
      Throws:
      DuplicateNameException - when a datatype of the same name already exists
      IOException
      See Also:

    • sizeof

      public int sizeof()
      Returns the size of this structure. It accounts for 32 vs 64 bit.
      Returns:
      the size of this structure

    • isValid

      public boolean isValid()