Target of offset into import directory unclear

Question

During RCE of a piece of code, I have found this:

    loc_40244F:
    mov eax, [ebx+20h]
    add ebx, 14h
    test eax, eax
    jnz loc_402397

What I know is that ebx points to the import directory structure of the considered PE file.

But when I look at it, I see the following:

     Import Directory
     +0 DWORD   OriginalFirstThunk; 
      4 DWORD   TimeDateStamp;
      8 DWORD   ForwarderChain; 
      c DWORD   Name;
     10 DWORD   FirstThunk;

So, to which location is the [ebx+20h] expression pointing ? I hope somebody can help me.

best regards,

Answer 1

If ebx really points to an IMAGE_IMPORT_DESCRIPTOR, then [ebx+20h] points to the name field of the next IMAGE_IMPORT_DESCRIPTOR.

mov eax, [ebx+20h] ;  0x20 = 0x14 + 0xc 

where 0x14 is sizeof(IMAGE_IMPORT_DESCRIPTOR) and 0x0c is offsetof(IMAGE_IMPORT_DESCRIPTOR, Name).

Also, remember that the last IMAGE_IMPORT_DESCRIPTOR is always an IMAGE_IMPORT_DESCRIPTOR with all fields set to 0 (according to the official PE documentation):

The last directory entry is empty (filled with null values), which indicates the end of the directory table

As noted by @peterferrie, if the Name field is NULL/0 then the other field are meaningless so your code is checking if the next IMAGE_IMPORT_DESCRIPTOR is the last, so it can stop processing the array of IMAGE_IMPORT_DESCRIPTOR.

You could surely test this by checking the value in eax and comparing it to the value in an hex editor or a PE browsing tool.