what is IAT? and how to find the end of the IAT in packed exe?

Question

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors.

Now i reached to the part that he show how to manually find the end of IAT and he said "you see, we can easy spot the end of the of the IAT, it's on 493854..."

0049380C  D0 E9 5F 73 C0 4A 65 73 70 68 65 73 A0 61 66 73  ׀י_sְJesphes afs
0049381C  50 C4 64 73 D0 66 65 73 40 6B 66 73 00 00 00 00  Pִds׀fes@kfs....
0049382C  C0 41 7E 75 10 0A 7A 75 00 00 00 00 00 F3 64 75  ְA~u.zu.....ףdu
0049383C  00 00 00 00 10 F4 00 77 00 6A 01 77 10 69 01 77  ....פ.w.jwiw
0049384C  00 00 00 00 6E 17 00 10 00 00 00 00 6B 65 72 6E  ....n.....kern
0049385C  65 6C 33 32 2E 64 6C 6C 00 00 00 00 44 65 6C 65  el32.dll....Dele
0049386C  74 65 43 72 69 74 69 63 61 6C 53 65 63 74 69 6F  teCriticalSectio
0049387C  6E 00 00 00 4C 65 61 76 65 43 72 69 74 69 63 61  n...LeaveCritica

Now I don't udnerstand how he know where the end of the IAT just from looking on the dump?

Also, I didn't completely understood what is IAT, any help will be great :-)

Answer 1

I didn't completely understood what is IAT, any help will be great :-)

The IAT is the Import Address Table. It's an an array of pointers to statically-imported API function addresses. The IAT entries gets populated at runtime.

The format of the IAT is typically as follows, with all functions from a particular DLL grouped together, with a null-pointer separating each DLL's list of function addresses:

<pointer to DLL #1's function A>, <pointer to DLL #1's function B>, <pointer to DLL #1's function C>, 0x00000000, <pointer to DLL #2's function D>, <pointer to DLL #2's function E>, ..., 0x00000000

Note that this format isn't required, but it's the most common format.

Now I don't udnerstand how he know where the end of the IAT just from looking on the dump?

I highlighted each IAT function below (with mspaint), with a different color for each DLL grouping. At virtual address 0x0049380C we see the function addresses 0x735FE9D0, 0x73654AC0, etc. You can tell that they're likely from the same DLL because:

1. There's no null-pointer separating them, and
2. They're all in the same address range (0x735F0000 - 0x7366FFFF)

The DWORD at 0x00493850 (after the null-pointer at 0x0049384C) is 0x1000176E, so you can look up that address in your debugger and see if there's DLL code loaded at that address. If not, 0x0049384C would mark the end of the IAT. If so, 0x00493854 would mark the end of the IAT since the data at 0x00493858 is the beginning of an ASCII string and clearly not a valid function pointer.