If I understand this correctly, this function pre-computes virtual addresses of imported DLLs and writes them to the IAT of an image (provided that
BIND_NO_UPDATE is not set as parameter). My understanding is that you do this to an image (on file) to make it start faster.
- How does the windows loader know that the image has already been bound (and that it does not need to compute virtual addresses)?
- In the DllCharacteristics in a PE file (in the optional header), there is a flag called
BindImageExfail if this is set?
- What is the difference between
BIND_NO_UPDATEif the only updating it does is to the IAT?