trailofbits / trailofbits/pe-parse
Extract delay-loaded libraries from import table
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 911
- Forks
- 171
- PR merge metrics
- No merged PRs in 30d
Description
First
Thanks for your good library for parsing PE files.
We use your library for extract dependencies of executable application on CQtDeployer project.
Trouble
Windows use the delay-loaded technology for load dependencies.
And it is very likely that these libraries are not visible when parsing the import table.
In the Micrasoft documentation site has a instruction of extracting delay-load libraries but they use system functions.
Question
How to extract delay load libraries uses your Library?.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the linked Microsoft documentation on delay-loaded DLLs, then compare its behavior with pe-parse's handling of the PE import table. Use the CQtDeployer dependency-extraction use case to define the expected result; done means delay-loaded libraries can be extracted through the library.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- operating-systems, reverse-engineering
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100