[ Quesion ] Delay Load Imports

[dfirence]

Does Goblin obtain the "Delay Loaded" imports from "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT"?

I see in the source: https://docs.rs/goblin/latest/goblin/pe/data_directories/struct.DataDirectories.html#method.get_delay_import_descriptor

I assume that when the IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT is present in the PE File then the developer should invoke the goblin get_delay_import_descriptor() on the file, and these would be obtained.

Am i assuming correctly?

[dfirence]

@m4b An7 chance you can answer this one, please?

[m4b]

Seems correct yes. Since it returns an optional if it is present then it’ll be Some.

if you’re asking whether a “delay loaded” import is described by this descriptor I assume so though I’m not super familiar with this.

is the struct returned from this function call not giving you the information you need for some task related to delay loaded imports?