Why is IAT filled with static addresses instead of function names?

Question

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is magically filled with addresses even before system load, not function names. Why is that? It's as if the linker wrote down the DLL name and all the function addresses from the DLL directly into the IAT at compile time. Who's to say the addresses won't change on a DLL update? Or on ASLR?

Why is there addresses in the IAT in the first place? Isn't it supposed to point to the function names and be changed at runtime? If there already exist "pre-compiled" addresses in the IAT, then why would we even need to go set up the IAT when the executable gets loaded?

Considering this, why do we even need OriginalFirstThunk? If IAT has the function names or the addresses it seems useless to me.

Answer 1

When the loader resolves the imports, then how does it know which functions to look for?

It parses the Import Table. For each entry, it parses the DLL name and associated function names and/or function ordinals.

For some reason the IAT (FirstThunk) is magically filled with addresses even before system load, not function names. Why is that?

It's for bound imports. There's a good explanation of bound imports at the bottom of Iczelion's Tutorial 6: Import Table in the Appendix.

Who's to say the addresses won't change on a DLL update? Or on ASLR?

They will very likely change, in which case the Windows loader will ignore the bound function addresses and replace those address in the IAT with the dynamically resolved function addresses at runtime.

Why is there addresses in the IAT in the first place? Isn't it supposed to point to the function names and be changed at runtime?

No, the Import Table contains the function names; the Import Address Table contains function addresses.