radare/radare2 — pull request #1006 by inisider (2014-06-04 20:08:24+00:00)
Title: fix import/delay import parsing for corkami

Fix parsing of import/delay import for corkami tests.

(in remote master)
f.e.:
./binr/rabin2/rabin2 -i ~/CoST.exe
[Imports]

0 imports
./binr/rabin2/rabin2 -i ~/delayimports.exe
[Imports]
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_ExitProcess
ordinal=002 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_LoadLibraryA
ordinal=003 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_GetProcAddress

3 imports

After patch:
./rabin2 -i ~/delayimports.exe:
[Imports]
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_ExitProcess
ordinal=002 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_LoadLibraryA
ordinal=003 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_GetProcAddress
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=msvcrt.dll_printf

4 imports

./rabin2 -i ~/CoST.exe:
Warning: Invalid import directory size: 0x27cd8126
[Imports]
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=cost.exe_4_Main
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_ExitProcess
ordinal=002 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_AddVectoredExceptionHandler
ordinal=003 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_OutputDebugStringA
ordinal=004 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_WriteConsoleA
ordinal=005 plt=0x00000000 bind=NONE type=FUNC name=kernel32.dll_GetStdHandle
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=gdi32.dll_EngQueryEMFInfo
ordinal=001 plt=0x00000000 bind=NONE type=FUNC name=ntdll.dll_ZwAllocateVirtualMemory

8 imports