What does BindImageEx actually do?

Question

Docs. If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that BIND_NO_UPDATE is not set as parameter). My understanding is that you do this to an image (on file) to make it start faster.

• How does the windows loader know that the image has already been bound (and that it does not need to compute virtual addresses)?
• In the DllCharacteristics in a PE file (in the optional header), there is a flag called NO_BIND. Does BindImageEx fail if this is set?
• What is the difference between BIND_NO_BOUND_IMPORTS and BIND_NO_UPDATE if the only updating it does is to the IAT?

Answer 1

Windows Loader Knows the import is bound because bind process also writes a timestamp of the bounded module

suppose x.exe is bound to y.dll
y.dll has a TimeDateStamp in it peheader
when bound it writes the TimeDateStamp of y.dll in the
_IMAGE_BOUND_IMPORT_DESCRIPTOR

0:000> dt ole32!_IMAGE_BOUND_IMPORT_DESCRIPTOR
   +0x000 TimeDateStamp    : Uint4B
   +0x004 OffsetModuleName : Uint2B
   +0x006 NumberOfModuleForwarderRefs : Uint2B
0:000>

The Api in Question has a callback StatusRoutine that will be called during the Binding Process
when you Pass noupdate the call back will still be called
you can do some inspection and may be take actions there but leave the exe un affected

BIND_NO_BOUND_IMPORTS does not write a new ImportTable

Quoting From Docs

BIND_NO_BOUND_IMPORTS 0x00000001

Do not generate a new import address table.

BIND_NO_UPDATE 0x00000002

Do not make changes to the file.