Line data Source code
1 : //! PE Delayed import module
2 : use std::marker::PhantomData;
3 :
4 : use crate::{common::FromFFI, declare_iterator, generic};
5 : use lief_ffi as ffi;
6 :
7 : pub struct DelayImport<'a> {
8 : ptr: cxx::UniquePtr<ffi::PE_DelayImport>,
9 : _owner: PhantomData<&'a ffi::PE_Binary>,
10 : }
11 :
12 : impl DelayImport<'_> {
13 : /// According to the official PE specifications, this value is reserved and should be set to 0
14 72 : pub fn attribute(&self) -> u32 {
15 72 : self.ptr.attribute()
16 72 : }
17 :
18 : /// Return the library's name (e.g. `kernel32.dll`)
19 72 : pub fn name(&self) -> String {
20 72 : self.ptr.name().to_string()
21 72 : }
22 :
23 : /// The RVA of the module handle (in the ``.data`` section).
24 : /// It is used for storage by the routine that is supplied to manage delay-loading.
25 72 : pub fn handle(&self) -> u32 {
26 72 : self.ptr.handle()
27 72 : }
28 :
29 : /// RVA of the delay-load import address table.
30 72 : pub fn iat(&self) -> u32 {
31 72 : self.ptr.iat()
32 72 : }
33 :
34 : /// RVA of the delay-load import names table.
35 : ///
36 : /// The content of this table has the layout as the Import lookup table
37 72 : pub fn names_table(&self) -> u32 {
38 72 : self.ptr.names_table()
39 72 : }
40 :
41 : /// RVA of the **bound** delay-load import address table or 0 if the table does not exist.
42 72 : pub fn biat(&self) -> u32 {
43 72 : self.ptr.biat()
44 72 : }
45 :
46 :
47 : /// RVA of the **unload** delay-load import address table or 0
48 : /// if the table does not exist.
49 : ///
50 : /// According to the PE specifications, this table is an
51 : /// exact copy of the delay import address table that can be
52 : /// used to to restore the original IAT the case of unloading.
53 72 : pub fn uiat(&self) -> u32 {
54 72 : self.ptr.uiat()
55 72 : }
56 :
57 : /// The timestamp of the DLL to which this image has been bound.
58 72 : pub fn timestamp(&self) -> u32 {
59 72 : self.ptr.timestamp()
60 72 : }
61 :
62 : /// Iterator over the DelayImport's entries ([`DelayImportEntry`])
63 72 : pub fn entries(&self) -> Entries {
64 72 : Entries::new(self.ptr.entries())
65 72 : }
66 : }
67 :
68 : impl std::fmt::Debug for DelayImport<'_> {
69 72 : fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
70 72 : f.debug_struct("DelayImport")
71 72 : .field("attribute", &self.attribute())
72 72 : .field("name", &self.name())
73 72 : .field("handle", &self.handle())
74 72 : .field("iat", &self.iat())
75 72 : .field("names_table", &self.names_table())
76 72 : .field("biat", &self.biat())
77 72 : .field("uiat", &self.uiat())
78 72 : .field("timestamp", &self.timestamp())
79 72 : .finish()
80 72 : }
81 : }
82 :
83 : impl<'a> FromFFI<ffi::PE_DelayImport> for DelayImport<'a> {
84 80 : fn from_ffi(ptr: cxx::UniquePtr<ffi::PE_DelayImport>) -> Self {
85 80 : DelayImport {
86 80 : ptr,
87 80 : _owner: PhantomData,
88 80 : }
89 80 : }
90 : }
91 :
92 : /// Structure that represents an entry (i.e. an import) in the delay import table.
93 : ///
94 : /// It implements the [`generic::Symbol`] trait that exposes [`generic::Symbol::name`] and
95 : /// [`generic::Symbol::value`].
96 : ///
97 : /// The meaning of [`generic::Symbol::value`] for this PE object is the address (as an RVA) in the
98 : /// IAT where the resolution should take place.
99 : pub struct DelayImportEntry<'a> {
100 : ptr: cxx::UniquePtr<ffi::PE_DelayImportEntry>,
101 : _owner: PhantomData<&'a ffi::PE_DelayImport>,
102 : }
103 :
104 : impl DelayImportEntry<'_> {
105 : /// `True` if it is an import by ordinal
106 0 : pub fn is_ordinal(&self) -> bool {
107 0 : self.ptr.is_ordinal()
108 0 : }
109 :
110 : /// The ordinal value
111 256 : pub fn ordinal(&self) -> u16 {
112 256 : self.ptr.ordinal()
113 256 : }
114 :
115 : /// See: [`DelayImportEntry::data`]
116 256 : pub fn hint_name_rva(&self) -> u64 {
117 256 : self.ptr.hint_name_rva()
118 256 : }
119 :
120 : /// Index into the export table that is used to speed-up the symbol resolution
121 256 : pub fn hint(&self) -> u16 {
122 256 : self.ptr.hint()
123 256 : }
124 :
125 : /// Value of the current entry in the Import Address Table.
126 256 : pub fn iat_value(&self) -> u64 {
127 256 : self.ptr.iat_value()
128 256 : }
129 :
130 : /// Raw value
131 256 : pub fn data(&self) -> u64 {
132 256 : self.ptr.data()
133 256 : }
134 :
135 : /// Demangled representation of the symbol or an empty string if it can't
136 : /// be demangled
137 0 : pub fn demangled_name(&self) -> String {
138 0 : self.ptr.demangled_name().to_string()
139 0 : }
140 : }
141 :
142 : impl generic::Symbol for DelayImportEntry<'_> {
143 768 : fn as_generic(&self) -> &ffi::AbstractSymbol {
144 768 : self.ptr.as_ref().unwrap().as_ref()
145 768 : }
146 : }
147 :
148 : impl std::fmt::Debug for DelayImportEntry<'_> {
149 256 : fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
150 256 : let base = self as &dyn generic::Symbol;
151 256 : f.debug_struct("DelayImportEntry")
152 256 : .field("base", &base)
153 256 : .field("ordinal", &self.ordinal())
154 256 : .field("hint_name_rva", &self.hint_name_rva())
155 256 : .field("hint", &self.hint())
156 256 : .field("iat_value", &self.iat_value())
157 256 : .field("data", &self.data())
158 256 : .finish()
159 256 : }
160 : }
161 :
162 : impl<'a> FromFFI<ffi::PE_DelayImportEntry> for DelayImportEntry<'a> {
163 256 : fn from_ffi(ptr: cxx::UniquePtr<ffi::PE_DelayImportEntry>) -> Self {
164 256 : Self {
165 256 : ptr,
166 256 : _owner: PhantomData,
167 256 : }
168 256 : }
169 : }
170 :
171 72 : declare_iterator!(
172 72 : DelayImports,
173 72 : DelayImport<'a>,
174 72 : ffi::PE_DelayImport,
175 72 : ffi::PE_Binary,
176 72 : ffi::PE_Binary_it_delay_imports
177 72 : );
178 256 : declare_iterator!(
179 256 : Entries,
180 256 : DelayImportEntry<'a>,
181 256 : ffi::PE_DelayImportEntry,
182 256 : ffi::PE_DelayImport,
183 256 : ffi::PE_DelayImport_it_entries
184 256 : );
|
