0 out of 1 rated this helpful - Rate this topic

Dumping Delay-Loaded Imports

Delay-loaded imports can be dumped using dumpbin /imports and show up with slightly different information than standard imports. They are segregated into their own section of the /imports dumping and are explicitly labeled as delay-loaded imports. If there is unload information present in the image, that is noted. If there is bind information present, the time/date stamp of the target DLL is noted along with the bound addresses of the imports.

Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ
Advertisement