third_party/pefile_py3/pefile.py
def parse_delay_import_directory(self, rva, size):
        """Walk and parse the delay import directory."""

        import_descs =  []
        error_count = 0
        while True:
            try:
                # If the RVA is invalid all would blow up. Some PEs seem to be
                # specially nasty and have an invalid RVA.
                data = self.get_data( rva, Structure(self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__).sizeof() )
            except PEFormatError as e:
                self.__warnings.append(
                    'Error parsing the Delay import directory at RVA: 0x%x' % ( rva ) )
                break

            file_offset = self.get_offset_from_rva(rva)
            import_desc =  self.__unpack_data__(
                self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__,
                data, file_offset = file_offset )


            # If the structure is all zeros, we reached the end of the list
            if not import_desc or import_desc.all_zeroes():
                break
            contains_addresses = False

            # Handle old import descriptor that has Virtual Addresses instead of RVAs
            # This version of import descriptor is created by old Visual Studio versions (pre 6.0)
            # Can only be present in 32-bit binaries (no 64-bit compiler existed at the time)
            # Sample: e8d3bff0c1a9a6955993f7a441121a2692261421e82fdfadaaded45d3bea9980
            if import_desc.grAttrs == 0 and self.FILE_HEADER.Machine == MACHINE_TYPE['IMAGE_FILE_MACHINE_I386']:
                import_desc.pBoundIAT = self.normalize_import_va(import_desc.pBoundIAT)
                import_desc.pIAT = self.normalize_import_va(import_desc.pIAT)
                import_desc.pINT = self.normalize_import_va(import_desc.pINT)
                import_desc.pUnloadIAT = self.normalize_import_va(import_desc.pUnloadIAT)
                import_desc.phmod = self.normalize_import_va(import_desc.pUnloadIAT)
                import_desc.szName = self.normalize_import_va(import_desc.szName)
                contains_addresses = True

            rva += import_desc.sizeof()

            # If the array of thunks is somewhere earlier than the import
            # descriptor we can set a maximum length for the array. Otherwise
            # just set a maximum length of the size of the file
            max_len = len(self.__data__) - file_offset
            if rva > import_desc.pINT or rva > import_desc.pIAT:
                max_len = max(rva-import_desc.pINT, rva-import_desc.pIAT)

            import_data = []
            try:
                import_data =  self.parse_imports(
                    import_desc.pINT,
                    import_desc.pIAT,
                    None,
                    max_len,
                    contains_addresses)
            except PEFormatError as e:
                self.__warnings.append(
                    'Error parsing the Delay import directory. '
                    'Invalid import data at RVA: 0x{0:x} ({1})'.format(
                        rva, e.value))

            if error_count > 5:
                self.__warnings.append(
                    'Too many errors parsing the Delay import directory. '
                    'Invalid import data at RVA: 0x{0:x}'.format(rva) )
                break

            if not import_data:
                error_count += 1
                continue

            if self.__total_import_symbols > MAX_IMPORT_SYMBOLS:
                self.__warnings.append(
                    'Error, too many imported symbols %d (>%s)' %
                    (self.__total_import_symbols, MAX_IMPORT_SYMBOLS) )
                break

            dll = self.get_string_at_rva(import_desc.szName, MAX_DLL_LENGTH)
            if not is_valid_dos_filename(dll):
                dll = b('*invalid*')

            if dll:
                for symbol in import_data:
                    if symbol.name is None:
                        funcname = ordlookup.ordLookup(dll.lower(), symbol.ordinal)
                        if funcname:
                            symbol.name = funcname
                import_descs.append(
                    ImportDescData(
                        struct = import_desc,
                        imports = import_data,
                        dll = dll))

        return import_descs
Walk and parse the delay import directory.
Walk and parse the delay import directory.
Walk and parse the delay import directory .
def parse_delay_import_directory(self, rva, size):
        import_descs =  []
        error_count = 0
        while True:
            try:
                data = self.get_data( rva, Structure(self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__).sizeof() )
            except PEFormatError as e:
                self.__warnings.append(
                    'Error parsing the Delay import directory at RVA: 0x%x' % ( rva ) )
                break
            file_offset = self.get_offset_from_rva(rva)
            import_desc =  self.__unpack_data__(
                self.__IMAGE_DELAY_IMPORT_DESCRIPTOR_format__,
                data, file_offset = file_offset )
            if not import_desc or import_desc.all_zeroes():
                break
            contains_addresses = False
            if import_desc.grAttrs == 0 and self.FILE_HEADER.Machine == MACHINE_TYPE['IMAGE_FILE_MACHINE_I386']:
                import_desc.pBoundIAT = self.normalize_import_va(import_desc.pBoundIAT)
                import_desc.pIAT = self.normalize_import_va(import_desc.pIAT)
                import_desc.pINT = self.normalize_import_va(import_desc.pINT)
                import_desc.pUnloadIAT = self.normalize_import_va(import_desc.pUnloadIAT)
                import_desc.phmod = self.normalize_import_va(import_desc.pUnloadIAT)
                import_desc.szName = self.normalize_import_va(import_desc.szName)
                contains_addresses = True
            rva += import_desc.sizeof()
            max_len = len(self.__data__) - file_offset
            if rva > import_desc.pINT or rva > import_desc.pIAT:
                max_len = max(rva-import_desc.pINT, rva-import_desc.pIAT)
            import_data = []
            try:
                import_data =  self.parse_imports(
                    import_desc.pINT,
                    import_desc.pIAT,
                    None,
                    max_len,
                    contains_addresses)
            except PEFormatError as e:
                self.__warnings.append(
                    'Error parsing the Delay import directory. '
                    'Invalid import data at RVA: 0x{0:x} ({1})'.format(
                        rva, e.value))
            if error_count > 5:
                self.__warnings.append(
                    'Too many errors parsing the Delay import directory. '
                    'Invalid import data at RVA: 0x{0:x}'.format(rva) )
                break
            if not import_data:
                error_count += 1
                continue
            if self.__total_import_symbols > MAX_IMPORT_SYMBOLS:
                self.__warnings.append(
                    'Error, too many imported symbols %d (>%s)' %
                    (self.__total_import_symbols, MAX_IMPORT_SYMBOLS) )
                break
            dll = self.get_string_at_rva(import_desc.szName, MAX_DLL_LENGTH)
            if not is_valid_dos_filename(dll):
                dll = b('*invalid*')
            if dll:
                for symbol in import_data:
                    if symbol.name is None:
                        funcname = ordlookup.ordLookup(dll.lower(), symbol.ordinal)
                        if funcname:
                            symbol.name = funcname
                import_descs.append(
                    ImportDescData(
                        struct = import_desc,
                        imports = import_data,
                        dll = dll))
        return import_descs
def parse_delay_import_directory ( self , rva , size ) : import_descs = [ ] error_count = 0 while True : try : data = self . get_data ( rva , Structure ( self . __IMAGE_DELAY_IMPORT_DESCRIPTOR_format__ ) . sizeof ( ) ) except PEFormatError as e : self . __warnings . append ( 'Error parsing the Delay import directory at RVA: 0x%x' % ( rva ) ) break file_offset = self . get_offset_from_rva ( rva ) import_desc = self . __unpack_data__ ( self . __IMAGE_DELAY_IMPORT_DESCRIPTOR_format__ , data , file_offset = file_offset ) if not import_desc or import_desc . all_zeroes ( ) : break contains_addresses = False if import_desc . grAttrs == 0 and self . FILE_HEADER . Machine == MACHINE_TYPE [ 'IMAGE_FILE_MACHINE_I386' ] : import_desc . pBoundIAT = self . normalize_import_va ( import_desc . pBoundIAT ) import_desc . pIAT = self . normalize_import_va ( import_desc . pIAT ) import_desc . pINT = self . normalize_import_va ( import_desc . pINT ) import_desc . pUnloadIAT = self . normalize_import_va ( import_desc . pUnloadIAT ) import_desc . phmod = self . normalize_import_va ( import_desc . pUnloadIAT ) import_desc . szName = self . normalize_import_va ( import_desc . szName ) contains_addresses = True rva += import_desc . sizeof ( ) max_len = len ( self . __data__ ) - file_offset if rva > import_desc . pINT or rva > import_desc . pIAT : max_len = max ( rva - import_desc . pINT , rva - import_desc . pIAT ) import_data = [ ] try : import_data = self . parse_imports ( import_desc . pINT , import_desc . pIAT , None , max_len , contains_addresses ) except PEFormatError as e : self . __warnings . append ( 'Error parsing the Delay import directory. ' 'Invalid import data at RVA: 0x{0:x} ({1})' . format ( rva , e . value ) ) if error_count > 5 : self . __warnings . append ( 'Too many errors parsing the Delay import directory. ' 'Invalid import data at RVA: 0x{0:x}' . format ( rva ) ) break if not import_data : error_count += 1 continue if self . __total_import_symbols > MAX_IMPORT_SYMBOLS : self . __warnings . append ( 'Error, too many imported symbols %d (>%s)' % ( self . __total_import_symbols , MAX_IMPORT_SYMBOLS ) ) break dll = self . get_string_at_rva ( import_desc . szName , MAX_DLL_LENGTH ) if not is_valid_dos_filename ( dll ) : dll = b ( '*invalid*' ) if dll : for symbol in import_data : if symbol . name is None : funcname = ordlookup . ordLookup ( dll . lower ( ) , symbol . ordinal ) if funcname : symbol . name = funcname import_descs . append ( ImportDescData ( struct = import_desc , imports = import_data , dll = dll ) ) return import_descs
Walk and parse the delay import directory.
Walk and parse the delay import directory .
"""Walk and parse the delay import directory.""" # If the RVA is invalid all would blow up. Some PEs seem to be # specially nasty and have an invalid RVA. # If the structure is all zeros, we reached the end of the list # Handle old import descriptor that has Virtual Addresses instead of RVAs # This version of import descriptor is created by old Visual Studio versions (pre 6.0) # Can only be present in 32-bit binaries (no 64-bit compiler existed at the time) # Sample: e8d3bff0c1a9a6955993f7a441121a2692261421e82fdfadaaded45d3bea9980 # If the array of thunks is somewhere earlier than the import # descriptor we can set a maximum length for the array. Otherwise # just set a maximum length of the size of the file
self
rva
size