According to what I know, Import Descriptor table is made of an array of
_IMAGE_IMPORT_DESCRIPTOR structures. There is one
_IMAGE_IMPORT_DESCRIPTOR for every dll that is imported.
I have an exe which has two
_IMAGE_IMPORT_DESCRIPTOR for kernel32.dll.
Why is this so?
Why does this exe need to import the dll twice ?
Note: I'm using PEview to see the PE structure. Is it possible that PEview is getting confused? Even if there is a problem with PEview is it possible for an exe to import the same dll twice?
I have another doubt regarding the TLS directory in the PE Structure.
Is the TLS directory/Table which is present in the
IMAGE_OPTIONAL_HEADER of the PE, present only when the exe/program uses implicit TLS (i.e.
__declspec(thread)) and not when we use API(i.e. explicit TLS using functions like
Is it common for program's to use this? I have read it in many places that this can be a heuristic for malicious executable.