Do anybody know that the 'import address table' is 'per DL' or 'copy in the PE executable format on the Windows server?'
LoadLibrary /
GetProcAddress
), you will have an Import address table when calling in other modules. You can make PE Use dumpin
utility with Visual Studio to see the import of:
An example on user32.dll:
C: \ Windows \ System32> D Pubin / Import user32.dll Microsoft (R) COFF / PE dumper version 10.00.30319.01 Copyright (c) Microsoft Corporation All Rights Reserved.
File user32.dll The dump of
file type: DLL
section contains the following import:
Ntdll.dll 7DC60000 Import address table 7DCCACEC import name table 0 time Date of Stamp 0 First Forward Reference Index 15 A NT Open 7A 9 wcscat_s 7AD wcscpy_s ...
... and notepad.ax ...
C: \ Windows \ System 32> Dumpbin / Import Notepad.XA
Microsoft (R) COFF / PE Dumper Version 10.00.30319.01 Copyright (C) Microsoft Corporation All rights reserved.
File Notepad.xa Dump
File Type: EXECUTABLE IMAGE
section contains the following import:
ADVAPI32. Dll 1001000 Import Address Table 100 A23 Import Name Table FFFFFFF Time Date Stamp FFFFFFFFFFFFF Index First Forward Reference 77C71C82 27E RegsVolueWW 77C7 BCD5 26E Regative ValueXW 77C7 BED4 230 Regkokeky ...
Comments
Post a Comment