PE delayed import table - need a description.
in [Win32 Kernel]
|
From: R.Wieser on 4 Oct 2009 17:13 Hello Liviu, > Sorry, but you sound overly presumptuous here. I don't mind, as long as my message comes across. But do you want to say that that is *not* what they ment ? If so, what *did* they mean ? And if they did actually mean it that way, why than is my statement presumptious ? Because I should not say that aloud ? I'm sorry, I guess I'm not *that* social. > My main point was that you had the right and full > answer from Remy within a few hours of posting, > but because you didn't "like" scribd.com it took > you almost a week to find it elsewhere. I did not get answer, I was told to look behind a closed door. And as I can't access that document I can confirm nor deny your claim that it actually contains the answer I was looking for. Can you ? > A secondary point is that, like it or not, but Microsoft's > document is the authoritative reference in this matter > and up-to-date, while usenet talk or even that MSJ > '02 article are neither. :-) The info I was looking for must be more than 9 years old. > That said, to each his own and, again, I am glad > that it all worked out for you in the end. Actually, I did put it aside for the weekend. I've yet to see if it actually does hold the answer. Regards, Rudy Wieser -- Origional message: Liviu <lab2k1(a)gmail.c0m> schreef in berichtnieuws #M9bWdQRKHA.1232(a)TK2MSFTNGP05.phx.gbl... > > "R.Wieser" <address(a)not.available> wrote... > > > > Allso, and please do not take this the wrong way, people here seem to > > have adopted the position that "just press the "accept" button, and > > than simply forget you've ever done so (cause they will never come > > to your doorstep)" attitude. Its like promoting stealing 'cause you > > won't ever get caught > > Sorry, but you sound overly presumptuous here. > > > Yes, I do make my life harder because of my rejection. > > My main point was that you had the right and full answer from Remy > within a few hours of posting, but because you didn't "like" scribd.com > it took you almost a week to find it elsewhere. A secondary point is > that, like it or not, but Microsoft's document is the authoritative > reference in this matter and up-to-date, while usenet talk or even that > MSJ '02 article are neither. > > That said, to each his own and, again, I am glad that it all worked out > for you in the end. > > Liviu > >
From: R.Wieser on 5 Oct 2009 08:46 Hello Stefan, I've looked at your files (As best as I could, I'm not a C++ user), and am still stuck on the same spot. In the "common\useimprt.cpp" file you have a function named "PeFileUsesImportDelayedT". As far as I can tell its used to check if a certain function is delay-loaded or not. The "GetImgDirEntryRVA" call returns a pointer to the DelayedImportTable-entry. A few lines the "GetImgDirEntryRVA" converts the contained pointer to a raw file pointer. Than I get lost : the "while ( pDelayDesc->rvaDLLName )" seems to want to get data at the pointer+4, as if the pointer points to a record. Alas, as I've now mentioned a number of times, the table I have is a simple table containing DWORDS, not records. And I *still* have no idea how to convert the table-provided value in anything meaningfull (read: to point somewhere in the program). For the "mswsock.dll" (w98se) the first table-value I have is BFF76E30, and the image-base address is 75E30000. Even when I subtract the latter from the former the resulting value is just too big, and does not point to any section in the program. Allso, there are *three* entries in that table with the value Zero (with one at the very end), where your code seems to stop scanning. If that is so it checks only part of that table ... I've been "at it", in this message-group, for a month now (and some time before it), and I'm getting tired of it (no offence ment or implied, you where quite willing to help). I think its clear that I fail to understand how it works. What I find suprising is that *noone* seems to have done the little bit of effort to look at what the DLT looks like (maybe confirming my "Its a table of DWORDS, not records" ?) and state the step I must do that I cannot seem to grasp. Thanks for your help, but I think I have to drop the whole thing if I do not want to get mad (in both its meanings). Regards, Rudy Wieser -- Origional message: Stefan Kuhr <kustt110(a)gmx.li> schreef in berichtnieuws eK10s8qQKHA.4600(a)TK2MSFTNGP05.phx.gbl... > Hi Rudy, > > R.Wieser wrote: > > Hello Stefan, > > > >> Did you take a look into the MSJ article, that I mentioned? > >> It explains how delayloading atually works. > > > > Where ? > > > > I found four references to the word "delay" : > > > > 1) > > ====== > > Optimizations such as delay loading of DLLs, section merging, and binding > > were still over the horizon > > ====== > > No info there. > > > > 2,3&4) > > ====== > > Visual C++ 6.0 added the delayload feature, which is a hybrid between > > implicit linking and explicit linking. When you delayload against a DLL, the > > linker emits something that looks very similar to the data for a regular > > imported DLL. However, the operating system ignores this data. Instead, the > > first time a call to one of the delayloaded APIs occurs, special stubs added > > by the linker cause the DLL to be loaded (if it's not already in memory), > > followed by a call to GetProcAddress to locate the called API. > > ====== > > Minimal info, nothing explicit. No description of *how* it works anywhere > > in sight. Not even a mentioning what that "delayed import table" is > > actually used for. :-\ > > > > May I mention that I allready found-and-read that article before I posted my > > question/request. > > > Ah I see you are talking about the msdn magazine article I referred to. > However, I asked: "Did you take a look into the MSJ article, that I > mentioned?". Look at the **MSJ** article from December 1998, that I > referred to as well. I hope it is still on the web somewhere. If you > have an older MSDN Library, it is under the "Periodicals" section. This > article might help. > > > > > Your article-code is only available there ? Bummer. (yes, its only > > available there. Although a quick Google-search showed 5 pages, all link > > back to that one article) > > > > Please send an email to the email address used for this newsgroup > posting. I normally do not monitor this email address, but I will do in > this case and send you the article's code. Although I really don't think > that it is too much of an effort to sign up at CodeProject. > > -- > S
From: Ben Voigt [C++ MVP] on 7 Oct 2009 00:52
>> The paragraph in question refers to patents. >> You cannot use a patented idea without a >> license, EVEN IF YOU DEVELOPED IT >> INDEPENDENTLY. > > I know. That much I *do* understand from patent-law. As its at the very > basis of patent-law I'm allso quit surprised that you think that is the > translation of part of that EULA (its superfluous, like stating that water > is wet) Then you understand that this statement you made is false: "Currently I can use the PE info I allready have for/in any program on any OS I please." If the information is covered by patent, you cannot use it. Unless you agree to the EULA, it is a Microsoft patent, and your use is as described (compiler tools on Windows). Then you are granted a license to use the patented idea. If it's a non-Microsoft patent, or you want to use it in some other way, you have to go negotiate with the patent owner for a license that permits your desired application. You are still not restricted from using your information in ways that don't infringe patents. > >> Go see a lawyer for a proper explanation. > > Thank you for the suggestion, but no thank you. > > I'm a hobbyist, and have no intention to get even anywhere near the > possibility of such a dispute. I allso have problems with the very notion > of something *I* need to agree to can only really be read-and-understood > by > another person, who ofcourse expects to be handsomely be payed for doing > so. I think I understand it, and I think you probably understand it too, but I am not licensed to give legal advice. So I put in that disclaimer. If you read the following sentence you'd realize quickly that it was only a disclaimer and not really my attitude. And I must unfortunately and to your great and everlasting amusement, tell you once again: I am not a lawyer. For a dependable interpretation of everything we are discussing you would need to consult one. > > Regards, > Rudy Wieser > > > -- Origional message: > Ben Voigt [C++ MVP] <bvoigt(a)newsgroup.nospam> schreef in berichtnieuws > 6ECB73FA-3D7A-468C-B1BF-8C0881E3AE13(a)microsoft.com... >> > If its that your "plain English, and very clearly granting" than pardon >> > me, >> > but I think you're a fool. >> > >> > Currently I can use the PE info I allready have for/in any program on > any >> > OS >> > I please. That is way more than I could do if I would accept that >> > EULA. >> > So >> > yes, I *do* think its trying to restrict (me) and not, as you seem to >> > think, >> > grant (me) anything. >> >> You're thinking of trade secret rules, where your rights depend on how >> you >> acquire the information (and the burden of proving you got it through an >> unencumbered source if you were privy to the same information through a >> restricted source). >> >> The paragraph in question refers to patents. You cannot use a patented > idea >> without a license, EVEN IF YOU DEVELOPED IT INDEPENDENTLY. Go see a > lawyer >> for a proper explanation. Of course that puts more money into the hands > of >> lawyers and encourages them to keep writing long complicated license >> agreements :( >> >> > > |