dissect.executable.pe.directory.imports

Module Contents

Classes

ImportDirectory	The import directory of a PE file.
ImportModule	A module imported by a PE file, containing its functions.
ImportFunction	A function imported from a module.

class dissect.executable.pe.directory.imports.ImportDirectory(pe: dissect.executable.pe.pe.PE, address: int, size: int)

Bases: dissect.executable.pe.directory.base.DataDirectory

The import directory of a PE file.

__repr__() → str

__len__() → int

__getitem__(idx: str | int) → ImportModule

__contains__(name: str) → bool

property modules: list[ImportModule]

List of imported modules.

class dissect.executable.pe.directory.imports.ImportModule(pe: dissect.executable.pe.pe.PE, descriptor: dissect.executable.pe.c_pe.c_pe.IMAGE_IMPORT_DESCRIPTOR)

A module imported by a PE file, containing its functions.

pe

descriptor

__repr__() → str

__iter__() → collections.abc.Iterator[ImportFunction]

__getitem__(idx: str | int) → ImportFunction

__contains__(idx: str | int) → bool

property timestamp: datetime.datetime | None

The timestamp of this import module, or None if the PE file is compiled as reproducible.

property name: str

The name of the imported module.

property functions: list[ImportFunction]

List of functions imported from this module.

class dissect.executable.pe.directory.imports.ImportFunction(module: ImportModule, lookup_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64, address_thunk: dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA32 | dissect.executable.pe.c_pe.c_pe.IMAGE_THUNK_DATA64)

A function imported from a module.

module

lookup_thunk

address_thunk

address

__repr__() → str