ea970ead2a
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
sdk-generator-smoke / sdk-smoke (push) Has been cancelled
SDK Publish & Sign / sdk-publish (push) Has been cancelled
api-governance / spectral-lint (push) Has been cancelled
oas-ci / oas-validate (push) Has been cancelled
Mirror Thin Bundle Sign & Verify / mirror-sign (push) Has been cancelled
66 lines
2.3 KiB
C#
66 lines
2.3 KiB
C#
namespace StellaOps.Scanner.Analyzers.Native;
|
|
|
|
/// <summary>
|
|
/// Represents a declared dependency extracted from PE import tables.
|
|
/// </summary>
|
|
/// <param name="DllName">The DLL name from the import table.</param>
|
|
/// <param name="ReasonCode">The reason code: "pe-import" or "pe-delayimport".</param>
|
|
/// <param name="ImportedFunctions">Names of imported functions (if available).</param>
|
|
public sealed record PeDeclaredDependency(
|
|
string DllName,
|
|
string ReasonCode,
|
|
IReadOnlyList<string> ImportedFunctions);
|
|
|
|
/// <summary>
|
|
/// Represents a Side-by-Side (SxS) assembly dependency from embedded manifest.
|
|
/// </summary>
|
|
/// <param name="Name">Assembly name (e.g., "Microsoft.Windows.Common-Controls").</param>
|
|
/// <param name="Version">Version string.</param>
|
|
/// <param name="PublicKeyToken">Public key token for strong-named assemblies.</param>
|
|
/// <param name="ProcessorArchitecture">Target architecture (x86, amd64, etc.).</param>
|
|
/// <param name="Type">Assembly type (e.g., "win32").</param>
|
|
public sealed record PeSxsDependency(
|
|
string Name,
|
|
string? Version,
|
|
string? PublicKeyToken,
|
|
string? ProcessorArchitecture,
|
|
string? Type);
|
|
|
|
/// <summary>
|
|
/// PE subsystem type.
|
|
/// </summary>
|
|
public enum PeSubsystem : ushort
|
|
{
|
|
Unknown = 0,
|
|
Native = 1,
|
|
WindowsGui = 2,
|
|
WindowsConsole = 3,
|
|
Os2Console = 5,
|
|
PosixConsole = 7,
|
|
NativeWindows = 8,
|
|
WindowsCeGui = 9,
|
|
EfiApplication = 10,
|
|
EfiBootServiceDriver = 11,
|
|
EfiRuntimeDriver = 12,
|
|
EfiRom = 13,
|
|
Xbox = 14,
|
|
WindowsBootApplication = 16,
|
|
}
|
|
|
|
/// <summary>
|
|
/// Contains all import information extracted from a PE binary.
|
|
/// </summary>
|
|
/// <param name="Machine">The target machine architecture.</param>
|
|
/// <param name="Subsystem">The PE subsystem type.</param>
|
|
/// <param name="Is64Bit">True if PE32+, false if PE32.</param>
|
|
/// <param name="Dependencies">Standard import table dependencies.</param>
|
|
/// <param name="DelayLoadDependencies">Delay-load import dependencies.</param>
|
|
/// <param name="SxsDependencies">Side-by-Side assembly dependencies from manifest.</param>
|
|
public sealed record PeImportInfo(
|
|
string? Machine,
|
|
PeSubsystem Subsystem,
|
|
bool Is64Bit,
|
|
IReadOnlyList<PeDeclaredDependency> Dependencies,
|
|
IReadOnlyList<PeDeclaredDependency> DelayLoadDependencies,
|
|
IReadOnlyList<PeSxsDependency> SxsDependencies);
|