During RCE of a piece of code, I have found this:

    mov eax, [ebx+20h]
    add ebx, 14h
    test eax, eax
    jnz loc_402397

What I know is that ebx points to the import directory structure of the considered PE file.

But when I look at it, I see the following:

     Import Directory
     +0 DWORD   OriginalFirstThunk; 
      4 DWORD   TimeDateStamp;
      8 DWORD   ForwarderChain; 
      c DWORD   Name;
     10 DWORD   FirstThunk;

So, to which location is the [ebx+20h] expression pointing ? I hope somebody can help me.

best regards,

1 Answer 1


If ebx really points to an IMAGE_IMPORT_DESCRIPTOR, then [ebx+20h] points to the name field of the next IMAGE_IMPORT_DESCRIPTOR.

mov eax, [ebx+20h] ;  0x20 = 0x14 + 0xc 

where 0x14 is sizeof(IMAGE_IMPORT_DESCRIPTOR) and 0x0c is offsetof(IMAGE_IMPORT_DESCRIPTOR, Name).

Also, remember that the last IMAGE_IMPORT_DESCRIPTOR is always an IMAGE_IMPORT_DESCRIPTOR with all fields set to 0 (according to the official PE documentation):

The last directory entry is empty (filled with null values), which indicates the end of the directory table

As noted by @peterferrie, if the Name field is NULL/0 then the other field are meaningless so your code is checking if the next IMAGE_IMPORT_DESCRIPTOR is the last, so it can stop processing the array of IMAGE_IMPORT_DESCRIPTOR.

You could surely test this by checking the value in eax and comparing it to the value in an hex editor or a PE browsing tool.

  • 1
    @Neitsa, not all fields set to zero, only the Name field must be zero. If there's no DLL named, then the other fields are meaningless and can hold any value. Commented Mar 29, 2015 at 22:01
  • @peterferrie Thanks a lot for your clarification, you're right. Although the PE documentation states that the last import descriptor must be all 0, having no Name field indicates the other fields are meaningless, so it's enough to only test the Name field. Edited my answer!
    – Neitsa
    Commented Mar 30, 2015 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.