I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/7673754/pe-format-iat-questions as a guide. I'm currently on number 4 and that's where things are getting a little fuzzy for me. I'm able to get a pointer to an entry within the DataDirectory array. I chose the 13th entry because from my research http://msdn.microsoft.com/en-us/library/windows/desktop/ms680305%28v=vs.85%29.aspx it looks like that will lead me to the IAT. I'm not sure I'm on the right track because this DataDirectory has the value for size = 0 and virtualaddress = 172. Is the virtualsize of 172 an offset that must be added to some base address? I'm just working with a simple C program with no debug info that prints, "Hello World". Any help is greatly appreciated. Not sure how much showing the code will help my methodology but I'll post the relevant parts below. Any help is appreciated. Thanks!
pDOSHeader = ctypes.cast(hModule, ctypes.POINTER(IMAGE_DOS_HEADER)).contents e_lfanew_offset = pDOSHeader.e_lfanew offset_to_NTHeaders = e_lfanew_offset + hModule pNTHeaders = ctypes.cast(offset_to_NTHeaders,ctypes.POINTER(IMAGE_NT_HEADERS)).contents pImage_NT_Headers = pNTHeaders.OptionalHeader pDataDirectory = pImage_NT_Headers.DataDirectory pDataDirectory_IAT = pDataDirectory