namespace StellaOps.Scanner.Analyzers.Native; /// /// Represents a declared dependency extracted from PE import tables. /// /// The DLL name from the import table. /// The reason code: "pe-import" or "pe-delayimport". /// Names of imported functions (if available). public sealed record PeDeclaredDependency( string DllName, string ReasonCode, IReadOnlyList ImportedFunctions); /// /// Represents a Side-by-Side (SxS) assembly dependency from embedded manifest. /// /// Assembly name (e.g., "Microsoft.Windows.Common-Controls"). /// Version string. /// Public key token for strong-named assemblies. /// Target architecture (x86, amd64, etc.). /// Assembly type (e.g., "win32"). public sealed record PeSxsDependency( string Name, string? Version, string? PublicKeyToken, string? ProcessorArchitecture, string? Type); /// /// PE subsystem type. /// public enum PeSubsystem : ushort { Unknown = 0, Native = 1, WindowsGui = 2, WindowsConsole = 3, Os2Console = 5, PosixConsole = 7, NativeWindows = 8, WindowsCeGui = 9, EfiApplication = 10, EfiBootServiceDriver = 11, EfiRuntimeDriver = 12, EfiRom = 13, Xbox = 14, WindowsBootApplication = 16, } /// /// Contains all import information extracted from a PE binary. /// /// The target machine architecture. /// The PE subsystem type. /// True if PE32+, false if PE32. /// Standard import table dependencies. /// Delay-load import dependencies. /// Side-by-Side assembly dependencies from manifest. public sealed record PeImportInfo( string? Machine, PeSubsystem Subsystem, bool Is64Bit, IReadOnlyList Dependencies, IReadOnlyList DelayLoadDependencies, IReadOnlyList SxsDependencies);