Does the loader fill the IAT table of an .exe in load time by checking the corresponding export tables or during run time?

Question

I came upon this question :

Can we hook the Nt or Zw functions using IAT hooking, or just inline hooking?

and it got me wondering, lets say for some reason some function was not in the IAT of our target PE in virtual memory, like the above question which is Zw/NtQuerySystemInformation (I'm still not sure why this is not included in IAT tho), so in this case if we wanted to hook the IAT, would it be possible to hook the export table of kernel32.dll or ntdll.dll and do it like that instead? because i assume this function has to be there at least

so this takes me back to the question, will the loader fill our IAT when its loading the PE into memory by checking the export tables, or when our program uses it? because if its the first case then I assume there is no way to hook the export table right?

also does anyone know why functions like ZwQuerySystemInformation dont get included in IAT but stuff like Sleep and GetProcAddress Does?

Answer 1

the Apis like Sleep are documented a header file is provided in the sdk a library to link against is provided by sdk (windows.h ,kernel32.lib)

api s like Zwxxx are internal or advanced user apis they or either undocumented or semidocumented or documented for usage in a kernel mode
these apis are not to be taken for granted to be either forward compatible or backward compatible

so if you use them then all the care that is required is to be taken by the one who is using them

so they are designed to be dynamically called using load library , getting the procedure address , casting the return as a typedeffed function pointer

they dont reside in IAT or loader doesnot resolve them

Answer 2

When does the PE loader fill in the IAT?

The IAT is updated at load time by the PE Loader [1], this is called Load-time dynamic linking, as opposed to Run-time dynamic linking, where LoadLibrary/GetProcAddress are necessary.

Hooking an API not included in Import Address Table

There are several ways to do that actually, and Export Address Table hooking is one of them. However, your hook must be installed before the target application looks up the API you want to hook.

Include Nt/Zw APIs in the IAT

also does anyone know why functions like ZwQuerySystemInformation dont get included in IAT but stuff like Sleep and GetProcAddress Does?

The only reason ZwQuerySystemInformation is not included in the IAT is because you didn't tell your linker to do it for you. You need need to link against ntdll import library (available by default in VS2017), or you can build you own.

On my system with mingw and clang installed, I was able to take the code from [2], remove any GetProcAddress/LoadLibrary calls, and build it. This gives:

#include <stdio.h>
#include <windows.h>
#include <winternl.h>

int main(void) {
    
    /* load the ntdll.dll */
    PVOID Info;
    /* create the string in the right format */
    UNICODE_STRING filename;
    RtlInitUnicodeString(&filename, L"C:\\temp.txt");

    /* initialize OBJECT_ATTRIBUTES */
    OBJECT_ATTRIBUTES obja;
    InitializeObjectAttributes(&obja, &filename, OBJ_CASE_INSENSITIVE, NULL, NULL);

    /* call NtOpenFile */
    IO_STATUS_BLOCK iostatusblock;
    HANDLE file = NULL;
    NTSTATUS stat = NtOpenFile(&file, FILE_WRITE_DATA, &obja, NULL, NULL, NULL);
    if(NT_SUCCESS(stat)) {
        printf("File successfully opened.\n");
    }
    else {
        printf("File could not be opened.\n");
    }

    getchar();
    return 0;
}

To build, I use:

clang -target x86_64-w64-windows-gnu toto.c -o toto.exe -lntdll

Then, IDA Free 7.0 allows us to see that NtOpenFile was successfully included in the IAT:

References

[1]: The Rootkit Arsenal, Bill Blunder, Chapter 11, p.480

[2]: Calling NTDLL functions directly, https://resources.infosecinstitute.com/calling-ntdll-functions-directly