I am writing a program where I map an
.exe PE file in memory and I "dissect" it.
I am disassembling the
.text section of the target executable, using the distorm disassembler.
CALL instructions in the disassembly have an offset relative to the
RIP register, e.g.:
CALL QWORD [RIP+0xf8e].
I am also reading the
Import Descriptor Table and I can see all the function calls from various .dlls there.
When using dumpbin.exe with
/section:.text /disasm to disassemble the same target
.exe, although it shows the same opcodes
ff 15 8e 0f 00 00, it somehow translates this RIP offset to the proper (and correct) Win32 function being called (in my program
call qword ptr [__imp_GetCurrentProcessId].
My question is how to "map"/resolve each
CALL instruction that I see in my disassembly to a specific Win32 API call, like dumpbin does, since I don't run this program inside the debugger and therefore the IAT is not overwritten by the Windows loader to show the proper
jmp instruction calling the Windows API. Is it a disassembler issue? Can I deduct this somehow using the various PE structures?