windows - Is "IMPORT ADDRESS TABLE" of PE per dll or per exe? -


Do anybody know that the 'import address table' is 'per DL' or 'copy in the PE executable format on the Windows server?'

LoadLibrary / GetProcAddress ), you will have an Import address table when calling in other modules.

You can make PE Use dumpin utility with Visual Studio to see the import of:

An example on user32.dll:

C: \ Windows \ System32> D Pubin / Import user32.dll Microsoft (R) COFF / PE dumper version 10.00.30319.01 Copyright (c) Microsoft Corporation All Rights Reserved.

File user32.dll The dump of

file type: DLL

section contains the following import:

  Ntdll.dll 7DC60000 Import address table 7DCCACEC import name table 0 time Date of Stamp 0 First Forward Reference Index 15 A NT Open 7A 9 wcscat_s 7AD wcscpy_s ...  

... and notepad.ax ...

C: \ Windows \ System 32> Dumpbin / Import Notepad.XA

Microsoft (R) COFF / PE Dumper Version 10.00.30319.01 Copyright (C) Microsoft Corporation All rights reserved.

File Notepad.xa Dump

File Type: EXECUTABLE IMAGE

section contains the following import:

  ADVAPI32. Dll 1001000 Import Address Table 100 A23 Import Name Table FFFFFFF Time Date Stamp FFFFFFFFFFFFF Index First Forward Reference 77C71C82 27E RegsVolueWW 77C7 BCD5 26E Regative ValueXW 77C7 BED4 230 Regkokeky ...  

Comments