wraith/structures/pe/
imports.rs

1//! Import structures
2
3#[cfg(all(not(feature = "std"), feature = "alloc"))]
4use alloc::string::String;
5
6#[cfg(feature = "std")]
7use std::string::String;
8
9#[repr(C)]
10#[derive(Debug, Clone, Copy)]
11pub struct ImportDescriptor {
12    pub original_first_thunk: u32, // RVA to INT (Import Name Table)
13    pub time_date_stamp: u32,
14    pub forwarder_chain: u32,
15    pub name: u32,        // RVA to DLL name
16    pub first_thunk: u32, // RVA to IAT (Import Address Table)
17}
18
19impl ImportDescriptor {
20    /// check if this is the null terminator
21    pub fn is_null(&self) -> bool {
22        self.original_first_thunk == 0 && self.name == 0 && self.first_thunk == 0
23    }
24}
25
26/// import lookup table entry (IMAGE_THUNK_DATA)
27#[repr(C)]
28#[derive(Clone, Copy)]
29pub union ThunkData32 {
30    pub forwarder_string: u32,
31    pub function: u32,
32    pub ordinal: u32,
33    pub address_of_data: u32,
34}
35
36#[repr(C)]
37#[derive(Clone, Copy)]
38pub union ThunkData64 {
39    pub forwarder_string: u64,
40    pub function: u64,
41    pub ordinal: u64,
42    pub address_of_data: u64,
43}
44
45pub const IMAGE_ORDINAL_FLAG32: u32 = 0x80000000;
46pub const IMAGE_ORDINAL_FLAG64: u64 = 0x8000000000000000;
47
48/// parsed import entry
49pub struct ImportLookupEntry {
50    pub is_ordinal: bool,
51    pub ordinal: u16,
52    pub hint: u16,
53    pub name: String,
54}
55
56/// import by name structure
57#[repr(C)]
58pub struct ImportByName {
59    pub hint: u16,
60    pub name: [u8; 1], // variable length
61}
wraith/structures/pe/imports.rs

wraith/structures/pe/
imports.rs
