using System.Runtime.InteropServices; namespace BurnOutSharp.Models.PortableExecutable { /// /// The delay-load directory table is the counterpart to the import directory /// table. It can be retrieved through the Delay Import Descriptor entry in /// the optional header data directories list (offset 200). /// /// [StructLayout(LayoutKind.Sequential)] public class DelayLoadDirectoryTableEntry { /// /// Must be zero. /// /// /// As yet, no attribute flags are defined. The linker sets this field to /// zero in the image. This field can be used to extend the record by /// indicating the presence of new fields, or it can be used to indicate /// behaviors to the delay or unload helper functions. /// public uint Attributes; /// /// The RVA of the name of the DLL to be loaded. The name resides in the /// read-only data section of the image. /// /// /// The name of the DLL to be delay-loaded resides in the read-only data /// section of the image. It is referenced through the szName field. /// public uint Name; /// /// The RVA of the module handle (in the data section of the image) of the DLL /// to be delay-loaded. It is used for storage by the routine that is supplied /// to manage delay-loading. /// /// /// The handle of the DLL to be delay-loaded is in the data section of the image. /// The phmod field points to the handle. The supplied delay-load helper uses /// this location to store the handle to the loaded DLL. /// public uint ModuleHandle; /// /// The RVA of the delay-load import address table. /// /// /// The delay import address table (IAT) is referenced by the delay import /// descriptor through the pIAT field. The delay-load helper updates these /// pointers with the real entry points so that the thunks are no longer in /// the calling loop. The function pointers are accessed by using the expression /// pINT->u1.Function. /// public uint DelayImportAddressTable; /// /// The RVA of the delay-load name table, which contains the names of the imports /// that might need to be loaded. This matches the layout of the import name table. /// /// /// The delay import name table (INT) contains the names of the imports that might /// require loading. They are ordered in the same fashion as the function pointers /// in the IAT. They consist of the same structures as the standard INT and are /// accessed by using the expression pINT->u1.AddressOfData->Name[0]. /// public uint DelayImportNameTable; /// /// The RVA of the bound delay-load address table, if it exists. /// /// /// The delay bound import address table (BIAT) is an optional table of /// IMAGE_THUNK_DATA items that is used along with the timestamp field of the /// delay-load directory table by a post-process binding phase. /// public uint BoundDelayImportTable; /// /// The RVA of the unload delay-load address table, if it exists. This is an exact /// copy of the delay import address table. If the caller unloads the DLL, this /// table should be copied back over the delay import address table so that /// subsequent calls to the DLL continue to use the thunking mechanism correctly. /// /// /// The delay unload import address table (UIAT) is an optional table of /// IMAGE_THUNK_DATA items that the unload code uses to handle an explicit unload /// request. It consists of initialized data in the read-only section that is an /// exact copy of the original IAT that referred the code to the delay-load thunks. /// On the unload request, the library can be freed, the *phmod cleared, and the /// UIAT written over the IAT to restore everything to its preload state. /// public uint UnloadDelayImportTable; /// /// The timestamp of the DLL to which this image has been bound. /// /// /// The delay bound import address table (BIAT) is an optional table of /// IMAGE_THUNK_DATA items that is used along with the timestamp field of the /// delay-load directory table by a post-process binding phase. /// public uint TimeStamp; } }