1

As I am still learning about PE using "Hello World" console app compiled with FASM, I find it challenging to understand the last part -- Import Table.

I refer to various posts and barely understand that there are IT, IAT and INT. I did refer to this article but it is intriguing this particular PE does not have Import Address Table?

[Data Directory]
Name                            RVA             Size
Export Table                    (N/A)           (N/A)
Import Table                    0x00003000      0x00000086
Resource Table                  (N/A)           (N/A)
Exception Table                 (N/A)           (N/A)
Security Table                  (N/A)           (N/A)
Base relocation Table           (N/A)           (N/A)
Debug                           (N/A)           (N/A)
Copyright                       (N/A)           (N/A)
Global Pointer                  (N/A)           (N/A)
Thread local storage            (N/A)           (N/A)
Load Configuration              (N/A)           (N/A)
Bound Import Table              (N/A)           (N/A)
Import Address Table            (N/A)           (N/A)
Delay Import Descriptor         (N/A)           (N/A)
COM Header                      (N/A)           (N/A)
Reserved                        (N/A)           (N/A)

The PE dump output shows that Import Table starts at memory location 0x00403000.

[Sections]
Name            RVA             V.Size          RAW             R.Size          Characteristics
.data           0x00001000      0x00000018      0x00000200      0x00000200      0xC0000040
.code           0x00002000      0x00000025      0x00000400      0x00000200      0xE0000000
.idata          0x00003000      0x00000086      0x00000600      0x00000200      0xC0000040

[Import Table]
KERNEL32.DLL
0       ExitProcess
0       GetStdHandle
0       WriteConsoleA

The code section make calls to kernel32.dll:

          call DWORD PTR ds:0x40304c // .idata [GetStdHandle]
          call DWORD PTR ds:0x403050 // .idata [WriteConsole]
          call DWORD PTR ds:0x0403048 // .idata [ExitProcess]

If I look up the Import Table, it actually points to:

0x40304c has "f0" (0x66 0x30)

0x403050 has "v0" (0x76 0x30)

0x403048 has "X0" (0x58 0x30)

So are those above the rvaImportAddressTable in IMAGE_IMPORT_DIRECTORY?

                  .idata:00403000 38                               0x38 '8'
                  .idata:00403001 30                               0x30 '0'
                  .idata:00403002 00                               0x00 
                  .idata:00403003 00                               0x00 
                  .idata:00403004 00                               0x00 
                  .idata:00403005 00                               0x00 
                  .idata:00403006 00                               0x00 
                  .idata:00403007 00                               0x00 
                  .idata:00403008 00                               0x00 
                  .idata:00403009 00                               0x00 
                  .idata:0040300a 00                               0x00 
                  .idata:0040300b 00                               0x00 
                  .idata:0040300c 28                               0x28 '('
                  .idata:0040300d 30                               0x30 '0'
                  .idata:0040300e 00                               0x00 
                  .idata:0040300f 00                               0x00 
                  .idata:00403010 48                               0x48 'H'
                  .idata:00403011 30                               0x30 '0'
                  .idata:00403012 00                               0x00 
                  .idata:00403013 00                               0x00 
                  .idata:00403014 00                               0x00 
                  .idata:00403015 00                               0x00 
                  .idata:00403016 00                               0x00 
                  .idata:00403017 00                               0x00 
                  .idata:00403018 00                               0x00 
                  .idata:00403019 00                               0x00 
                  .idata:0040301a 00                               0x00 
                  .idata:0040301b 00                               0x00 
                  .idata:0040301c 00                               0x00 
                  .idata:0040301d 00                               0x00 
                  .idata:0040301e 00                               0x00 
                  .idata:0040301f 00                               0x00 
                  .idata:00403020 00                               0x00 
                  .idata:00403021 00                               0x00 
                  .idata:00403022 00                               0x00 
                  .idata:00403023 00                               0x00 
                  .idata:00403024 00                               0x00 
                  .idata:00403025 00                               0x00 
                  .idata:00403026 00                               0x00 
                  .idata:00403027 00                               0x00 
                  .idata:00403028 4b                               0x4b 'K'
                  .idata:00403029 45                               0x45 'E'
                  .idata:0040302a 52                               0x52 'R'
                  .idata:0040302b 4e                               0x4e 'N'
                  .idata:0040302c 45                               0x45 'E'
                  .idata:0040302d 4c                               0x4c 'L'
                  .idata:0040302e 33                               0x33 '3'
                  .idata:0040302f 32                               0x32 '2'
                  .idata:00403030 2e                               0x2e '.'
                  .idata:00403031 44                               0x44 'D'
                  .idata:00403032 4c                               0x4c 'L'
                  .idata:00403033 4c                               0x4c 'L'
                  .idata:00403034 00                               0x00 
                  .idata:00403035 00                               0x00 
                  .idata:00403036 00                               0x00 
                  .idata:00403037 00                               0x00 
                  .idata:00403038 58                               0x58 'X'
                  .idata:00403039 30                               0x30 '0'
                  .idata:0040303a 00                               0x00 
                  .idata:0040303b 00                               0x00 
                  .idata:0040303c 66                               0x66 'f'
                  .idata:0040303d 30                               0x30 '0'
                  .idata:0040303e 00                               0x00 
                  .idata:0040303f 00                               0x00 
                  .idata:00403040 76                               0x76 'v'
                  .idata:00403041 30                               0x30 '0'
                  .idata:00403042 00                               0x00 
                  .idata:00403043 00                               0x00 
                  .idata:00403044 00                               0x00 
                  .idata:00403045 00                               0x00 
                  .idata:00403046 00                               0x00 
                  .idata:00403047 00                               0x00 
                  .idata:00403048 58                               0x58 'X'
                  .idata:00403049 30                               0x30 '0'
                  .idata:0040304a 00                               0x00 
                  .idata:0040304b 00                               0x00 
                  .idata:0040304c 66                               0x66 'f'
                  .idata:0040304d 30                               0x30 '0'
                  .idata:0040304e 00                               0x00 
                  .idata:0040304f 00                               0x00 
                  .idata:00403050 76                               0x76 'v'
                  .idata:00403051 30                               0x30 '0'
                  .idata:00403052 00                               0x00 
                  .idata:00403053 00                               0x00 
                  .idata:00403054 00                               0x00 
                  .idata:00403055 00                               0x00 
                  .idata:00403056 00                               0x00 
                  .idata:00403057 00                               0x00 
                  .idata:00403058 00                               0x00 
                  .idata:00403059 00                               0x00 
                  .idata:0040305a 45                               0x45 'E'
                  .idata:0040305b 78                               0x78 'x'
                  .idata:0040305c 69                               0x69 'i'
                  .idata:0040305d 74                               0x74 't'
                  .idata:0040305e 50                               0x50 'P'
                  .idata:0040305f 72                               0x72 'r'
                  .idata:00403060 6f                               0x6f 'o'
                  .idata:00403061 63                               0x63 'c'
                  .idata:00403062 65                               0x65 'e'
                  .idata:00403063 73                               0x73 's'
                  .idata:00403064 73                               0x73 's'
                  .idata:00403065 00                               0x00 
                  .idata:00403066 00                               0x00 
                  .idata:00403067 00                               0x00 
                  .idata:00403068 47                               0x47 'G'
                  .idata:00403069 65                               0x65 'e'
                  .idata:0040306a 74                               0x74 't'
                  .idata:0040306b 53                               0x53 'S'
                  .idata:0040306c 74                               0x74 't'
                  .idata:0040306d 64                               0x64 'd'
                  .idata:0040306e 48                               0x48 'H'
                  .idata:0040306f 61                               0x61 'a'
                  .idata:00403070 6e                               0x6e 'n'
                  .idata:00403071 64                               0x64 'd'
                  .idata:00403072 6c                               0x6c 'l'
                  .idata:00403073 65                               0x65 'e'
                  .idata:00403074 00                               0x00 
                  .idata:00403075 00                               0x00 
                  .idata:00403076 00                               0x00 
                  .idata:00403077 00                               0x00 
                  .idata:00403078 57                               0x57 'W'
                  .idata:00403079 72                               0x72 'r'
                  .idata:0040307a 69                               0x69 'i'
                  .idata:0040307b 74                               0x74 't'
                  .idata:0040307c 65                               0x65 'e'
                  .idata:0040307d 43                               0x43 'C'
                  .idata:0040307e 6f                               0x6f 'o'
                  .idata:0040307f 6e                               0x6e 'n'
                  .idata:00403080 73                               0x73 's'
                  .idata:00403081 6f                               0x6f 'o'
                  .idata:00403082 6c                               0x6c 'l'
                  .idata:00403083 65                               0x65 'e'
                  .idata:00403084 41                               0x41 'A'
                  .idata:00403085 00                               0x00 

According to the article referred by hyperlink above, IMAGE_IMPORT_DIRECTORY is defined as:

Public Type IMAGE_IMPORT_DIRECTORY
    rvaImportLookupTable As Long
    TimeDateStamp As Long
    ForwarderChain As Long
    rvaModuleName As Long
    rvaImportAddressTable As Long
End Type

Given the hexadecimal dump of Import Table above, does it mean fields like TimeDateStamp can be omitted?

Any clarification is greatly appreciated.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy