1

I’m doing a small research regarding PE files and while I drilled every related question or the documentation itself I couldn’t explain this issue.

Why can I go to CFF explorer or some other PE editing software and nullify the IMAGE_IAT_DIRECTORY in the OptionalHeader and the program will still run fine?

As far as I understood, the loader will iterate the array of PIMAGE_THUNK_DATA pointed by OriginalFirstThunk, will parse the symbol, and then will overwrite the memory pointed by FirstThunk with the corresponding function address.

I also understood that the IMAGE_IAT_DIRECTORY Will serve as a container for these function pointer arrays, for each corresponding FirstThunk in each IMAGE_IMPORT_DESCRIPTOR. When is it needed for an IAT directory to exist? Can it be that a lack of this directory will prevent an file from starting?

Thanks!

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.