Extract delay-loaded libraries from import table

[trailofbits]

Extract delay-loaded libraries from import table

[woodruffw]

Thank you for the kind words!

It should be possible to support delay-loaded imports (from a quick glance, they look like Windows' version of late/lazy bound symbols), but I can't offer you an exact timeline on when I (or someone else) will get around to implementing support for them.

I'm going to tag this with a few things; someone from the community may pick it up.

[EndrII]

Thanks, We will be wait.

[woodruffw]

The fact that the delay-load imports are stored in .didata appears to be an implementation detail, so we can't rely on that. We need to go through the data directory descriptor manually.

[woodruffw]

Just dumping this here for more context:

To do this, pe-parse will need to jump through the following hoops:

• Check for the delay import descriptor (offset 200/216) in the optional header data directories
• Parse the delay-load directory table (source)
• Use the information from the delay-load directory table to actually parse the delay-load import section (.didata), which is formatted identically to the normal import section (.idata)