dissect.executable.pe.directory.delay_import

Module Contents

Classes

DelayImportDirectory	The delay import directory of a PE file.
DelayImportModule	A module delay imported by a PE file, containing its functions.
DelayImportFunction	A function delay imported from a module.

class dissect.executable.pe.directory.delay_import.DelayImportDirectory(pe: dissect.executable.pe.pe.PE, address: int, size: int)

Bases: dissect.executable.pe.directory.base.DataDirectory

The delay import directory of a PE file.

__repr__() → str

__len__() → int

__getitem__(idx: str | int) → DelayImportModule

__contains__(name: str) → bool

property modules: list[DelayImportModule]

List of delay imported modules.

class dissect.executable.pe.directory.delay_import.DelayImportModule(pe: dissect.executable.pe.pe.PE, descriptor: dissect.executable.pe.c_pe.c_pe.IMAGE_DELAYLOAD_DESCRIPTOR)

A module delay imported by a PE file, containing its functions.

pe

descriptor

__repr__() → str

__iter__() → collections.abc.Iterator[DelayImportFunction]

__getitem__(idx: str | int) → DelayImportFunction

__contains__(idx: str | int) → bool

property timestamp: datetime.datetime | None

The timestamp of the target DLL of this delay import module, or None if the PE file is compiled as reproducible.

Will be 0 (so epoch) if it’s not bound yet.

property name: str

The name of the delay import module.

property functions: list[DelayImportFunction]

List of delay imported functions from this module.

class dissect.executable.pe.directory.delay_import.DelayImportFunction(module: DelayImportModule, name_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64, address_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64, bound_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64 | None = None, unload_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64 | None = None)

A function delay imported from a module.

module

name_thunk

address_thunk

address

bound_address = None

unload_address = None

__repr__() → str