¿Qué es una tabla de importación?

What is an import table?

The Import Address Table (IAT) is a call table of user-space modules. The executable modules running on Windows possess one or more IATs integrated as part of their file structures. For example, in case of an .exe file, an IAT stores the addresses of particular library functions imported from DLLs.

One section of note is the import address table (IAT), which is used as a lookup table when the application is calling a function in a different module. It can be in the form of both import by ordinal and import by name.

Data directories. Address/size pairs for special tables that are found in the image file and are used by the operating system (for example, the import table and the export table).

When building applications on Windows, the linker sends instruction to a binary called winstub.exe to the executable file. This file is kept in the address 0x3c, which is offset to the next PE header section.

The PE entry point is defined in the IMAGE_OPTIONAL_HEADER structure, in the AddressOfEntryPoint field: A pointer to the entry point function, relative to the image base address. For executable files, this is the starting address. For device drivers, this is the address of the initialization function.

I’m looking for a command line program to add an entry to the import table of a PE file. My goal is to add a new imported function from an external DLL to my EXE, and then with ollydbg insert new code using code caves. The new code will use the newly imported function.

Does anyone know whether the ‘import address table’ in the PE executable format on Windows is ‘per dll’ or ‘per exe’? Any PE can have an import address table, so both DLLs and EXEs can have them. This makes sense since both can have dependencies (imports) on other binaries.

// Open executable on disk var peFile = new PeFile (“myapp.exe”); // add function StartPage of the gdi32.dll to the import table of the opened .exe file inside memory.

With PE Explorer file headers, data directories, section headers and export tables are ready and waiting for your command. Use it for serious development projects, for restoring lost information, for keeping damaged files intact, to reverse engineer projects with missing source code, or to view the imports/exports of the standard DLL’s. [ more…]