PE delayed import table - need a description.
in [Win32 Kernel]
|
From: R.Wieser on 28 Sep 2009 10:29 Hello all, I'm trying to make sense of the "delayed import" table-data of the ws2_32 DLL, but all I see is a table of dwords which meaning escapes me. I've searched the Web (to which a Google-search returns surprisingly few results), but not even MS itself seems to bother to explain it. My question therefore is : Does anyone know of a (good) description of how to interpret those values, and is willing to share it ? Regards, Rudy Wieser
From: Remy Lebeau on 28 Sep 2009 19:59 "R.Wieser" <address(a)not.available> wrote in message news:%23aUcufEQKHA.3540(a)TK2MSFTNGP04.phx.gbl... > My question therefore is : Does anyone know of a (good) description of how > to interpret those values, and is willing to share it ? Have a look at Section 5.8 of the following specification: Microsoft Portable Execution and Common Object File Format Specification http://www.scribd.com/doc/8345966/Microsoft-Portable-Execution-and-Common-Object-FIle-Format-Specification -- Remy Lebeau (TeamB)
From: R.Wieser on 29 Sep 2009 13:41 Hello Remy, Thanks for that link. Alas, due to abusive JavaScript usage (even a simple link is AJAX-ified) I'm not able to look at the document itself (My computer has, for the obvious reasons, JS disabeled). I fond the same-named document with a date of 2008 on the MS site but that one had a EULA attached to it. A no-go for a hobbyist like me. I allso found a same-named document with a date of Feb 1999, but although it names the delay-import table they claim its the same as the normal import-table (if it was I would noticed and not have needed to ask my question :-\ ). To me the delayed-import table looks like an array of DWORDs, which contents I cannot even translate to normal adresses (not pointing inside any of the sections). Any ida what these values signify (are they actually DWORds ?) Regards, Rudy Wieser -- Origional message Remy Lebeau <no.spam(a)no.spam.com> schreef in berichtnieuws O$$lHfJQKHA.5052(a)TK2MSFTNGP06.phx.gbl... > > "R.Wieser" <address(a)not.available> wrote in message > news:%23aUcufEQKHA.3540(a)TK2MSFTNGP04.phx.gbl... > > > My question therefore is : Does anyone know of a (good) description of how > > to interpret those values, and is willing to share it ? > > Have a look at Section 5.8 of the following specification: > > Microsoft Portable Execution and Common Object File Format Specification > http://www.scribd.com/doc/8345966/Microsoft-Portable-Execution-and-Common-Ob ject-FIle-Format-Specification > > -- > Remy Lebeau (TeamB)
From: Remy Lebeau on 29 Sep 2009 15:56 "R.Wieser" <address(a)not.available> wrote in message news:et5PxvSQKHA.220(a)TK2MSFTNGP02.phx.gbl... > I fond the same-named document with a date of 2008 on the MS > site That is the same document as the one I pointed you to earlier. > that one had a EULA attached to it. A no-go for a hobbyist like me. Whats wrong with the EULA? > To me the delayed-import table looks like an array of DWORDs, > which contents I cannot even translate to normal adresses (not > pointing inside any of the sections). Any ida what these values > signify (are they actually DWORds ?) That information is described in detail in Microsoft's document. I strongly suggest you agree to the EULA and download it. It is free. -- Remy Lebeau (TeamB)
From: m on 29 Sep 2009 21:41
IIRC ws2_32.DLL exports by ordinal instead of by name (as with most DLLs). If you look at the PE spec from Microsoft, you will be able to make more sense of this, but looking at GetProcAddress in MSDN may also help. Usually this work is done for you by the OS, so I wonder what you are trying to achieve? "R.Wieser" <address(a)not.available> wrote in message news:%23aUcufEQKHA.3540(a)TK2MSFTNGP04.phx.gbl... > Hello all, > > I'm trying to make sense of the "delayed import" table-data of the ws2_32 > DLL, but all I see is a table of dwords which meaning escapes me. I've > searched the Web (to which a Google-search returns surprisingly few > results), but not even MS itself seems to bother to explain it. > > My question therefore is : Does anyone know of a (good) description of how > to interpret those values, and is willing to share it ? > > Regards, > Rudy Wieser > > > |