diff --git a/BurnOutSharp.Models/PortableExecutable/DelayLoadDirectoryTableEntry.cs b/BurnOutSharp.Models/PortableExecutable/DelayLoadDirectoryTableEntry.cs new file mode 100644 index 00000000..3fea2757 --- /dev/null +++ b/BurnOutSharp.Models/PortableExecutable/DelayLoadDirectoryTableEntry.cs @@ -0,0 +1,107 @@ +using System.Runtime.InteropServices; + +namespace BurnOutSharp.Models.PortableExecutable +{ + /// + /// The delay-load directory table is the counterpart to the import directory + /// table. It can be retrieved through the Delay Import Descriptor entry in + /// the optional header data directories list (offset 200). + /// + /// + [StructLayout(LayoutKind.Sequential)] + public class DelayLoadDirectoryTableEntry + { + /// + /// Must be zero. + /// + /// + /// As yet, no attribute flags are defined. The linker sets this field to + /// zero in the image. This field can be used to extend the record by + /// indicating the presence of new fields, or it can be used to indicate + /// behaviors to the delay or unload helper functions. + /// + public uint Attributes; + + /// + /// The RVA of the name of the DLL to be loaded. The name resides in the + /// read-only data section of the image. + /// + /// + /// The name of the DLL to be delay-loaded resides in the read-only data + /// section of the image. It is referenced through the szName field. + /// + public uint Name; + + /// + /// The RVA of the module handle (in the data section of the image) of the DLL + /// to be delay-loaded. It is used for storage by the routine that is supplied + /// to manage delay-loading. + /// + /// + /// The handle of the DLL to be delay-loaded is in the data section of the image. + /// The phmod field points to the handle. The supplied delay-load helper uses + /// this location to store the handle to the loaded DLL. + /// + public uint ModuleHandle; + + /// + /// The RVA of the delay-load import address table. + /// + /// + /// The delay import address table (IAT) is referenced by the delay import + /// descriptor through the pIAT field. The delay-load helper updates these + /// pointers with the real entry points so that the thunks are no longer in + /// the calling loop. The function pointers are accessed by using the expression + /// pINT->u1.Function. + /// + public uint DelayImportAddressTable; + + /// + /// The RVA of the delay-load name table, which contains the names of the imports + /// that might need to be loaded. This matches the layout of the import name table. + /// + /// + /// The delay import name table (INT) contains the names of the imports that might + /// require loading. They are ordered in the same fashion as the function pointers + /// in the IAT. They consist of the same structures as the standard INT and are + /// accessed by using the expression pINT->u1.AddressOfData->Name[0]. + /// + public uint DelayImportNameTable; + + /// + /// The RVA of the bound delay-load address table, if it exists. + /// + /// + /// The delay bound import address table (BIAT) is an optional table of + /// IMAGE_THUNK_DATA items that is used along with the timestamp field of the + /// delay-load directory table by a post-process binding phase. + /// + public uint BoundDelayImportTable; + + /// + /// The RVA of the unload delay-load address table, if it exists. This is an exact + /// copy of the delay import address table. If the caller unloads the DLL, this + /// table should be copied back over the delay import address table so that + /// subsequent calls to the DLL continue to use the thunking mechanism correctly. + /// + /// + /// The delay unload import address table (UIAT) is an optional table of + /// IMAGE_THUNK_DATA items that the unload code uses to handle an explicit unload + /// request. It consists of initialized data in the read-only section that is an + /// exact copy of the original IAT that referred the code to the delay-load thunks. + /// On the unload request, the library can be freed, the *phmod cleared, and the + /// UIAT written over the IAT to restore everything to its preload state. + /// + public uint UnloadDelayImportTable; + + /// + /// The timestamp of the DLL to which this image has been bound. + /// + /// + /// The delay bound import address table (BIAT) is an optional table of + /// IMAGE_THUNK_DATA items that is used along with the timestamp field of the + /// delay-load directory table by a post-process binding phase. + /// + public uint TimeStamp; + } +} diff --git a/BurnOutSharp.Models/PortableExecutable/Executable.cs b/BurnOutSharp.Models/PortableExecutable/Executable.cs index 89794959..fabefbbc 100644 --- a/BurnOutSharp.Models/PortableExecutable/Executable.cs +++ b/BurnOutSharp.Models/PortableExecutable/Executable.cs @@ -51,6 +51,11 @@ namespace BurnOutSharp.Models.PortableExecutable /// public AttributeCertificateTableEntry[] AttributeCertificateTable { get; set; } - // TODO: Left off at "Delay-Load Import Tables (Image Only)" + /// + /// Delay-load directory table + /// + public DelayLoadDirectoryTableEntry[] DelayLoadDirectoryTable { get; set; } + + // TODO: Left off at "Special Sections" } }