According to what I know, Import Descriptor table is made of an array of _IMAGE_IMPORT_DESCRIPTOR structures. There is one _IMAGE_IMPORT_DESCRIPTOR for every dll that is imported.

I have an exe which has two _IMAGE_IMPORT_DESCRIPTOR for kernel32.dll.
Why is this so?
Why does this exe need to import the dll twice ?

Note: I'm using PEview to see the PE structure. Is it possible that PEview is getting confused? Even if there is a problem with PEview is it possible for an exe to import the same dll twice?

I have another doubt regarding the TLS directory in the PE Structure.

Is the TLS directory/Table which is present in the IMAGE_OPTIONAL_HEADER of the PE, present only when the exe/program uses implicit TLS (i.e. __declspec(thread)) and not when we use API(i.e. explicit TLS using functions like TlsAlloc, TlsFree, TlsSetValue and TlsGetValue etc.).

Is it common for program's to use this? I have read it in many places that this can be a heuristic for malicious executable.

  • It just means that linker decided to put it twice. Its been quite a time since I have last seen Borland programs but back then Borland's linker always generated 2 and even 3 imports for some of dlls.
    – qwm
    Apr 23 '15 at 16:52
  • @qwn thanks so there is nothing malicious about it...
    – rebel87
    Apr 24 '15 at 5:52
  • the TLS question should probably be asked separately, and my answer split as a result. Apr 24 '15 at 16:07

The import table can theoretically have as many references to a DLL as there are imports. It is a function of the linker that produces this effect, and in some cases, the linker does not perform any kind of string pooling.

Borland products treat units as stand-alone objects, so any imported functions that are used are included without reference to any others. The effect is a DLL name, a group of imports for that DLL for the first unit; a DLL name (which might be duplicated), a group of imports for that DLL for the second unit (any or all of which might also be duplicated from the first group); and so on.

As far as TLS goes, the TLS directory entry is present only when the program uses EXplicit TLS. i.e. it declares a static TLS entry that the linker can see, and which Windows must initialise when the program first starts (because the program might use it immediately). The use of dynamic TLS (TlsAlloc, TlsFree) is entirely within program control, and the program is required to perform the initialisation itself.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.