What's the difference between the Import Table and the Import Address Table?
As general, I recommend reading the PE Format documentation on MSDN regarding the PE structure.
The Import Table is actually called "Import Directory Table" and contains entries for every DLL which is loaded by the executable. Each entry contains, among other, Import Lookup Table (ILT) and Import Address Table (IAT)
To quote from the PE format specs about Import Directory Table:
Import Directory Table
The import information begins with the import directory table, which describes the remainder of the import information. The import directory table contains address information that is used to resolve fixup references to the entry points within a DLL image. The import directory table consists of an array of import directory entries, one entry for each DLL to which the image refers. The last directory entry is empty (filled with null values), which indicates the end of the directory table. Each import directory entry has the following format:
Offset Size Field 0 4 Import Lookup Table RVA 4 4 Time/Date Stamp 8 4 Forwarder Chain 12 4 Name RVA 16 4 Import Address Table RVA
Import Address Table
The Import Address Table is comprised of function pointers, ans is used to get the addresses of functions when the DLLs are loaded. A compiled application was designed so that all API calls will not use direct hardcoded addresses but rather work through a function pointer. The pointer table can be accessed in several ways -- either directly by a call to
[pointer address] or by the "Import Lookup Table" and the "Hint/Name Table".
Let's quote again from the PE specs about the "Import Address Table":
Import Address Table
The structure and content of the import address table are identical to those of the import lookup table, until the file is bound. During binding, the entries in the import address table are overwritten with the 32-bit (for PE32) or 64-bit (for PE32+) addresses of the symbols that are being imported. These addresses are the actual memory addresses of the symbols, although technically they are still called "virtual addresses." The loader typically processes the binding.