When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is magically filled with addresses even before system load, not function names. Why is that? It's as if the linker wrote down the DLL name and all the function addresses from the DLL directly into the IAT at compile time. Who's to say the addresses won't change on a DLL update? Or on ASLR?
Why is there addresses in the IAT in the first place? Isn't it supposed to point to the function names and be changed at runtime? If there already exist "pre-compiled" addresses in the IAT, then why would we even need to go set up the IAT when the executable gets loaded?
Considering this, why do we even need OriginalFirstThunk? If IAT has the function names or the addresses it seems useless to me.