What is an Import address Table?
Import Address Table (IAT) is an array of these function pointers where the address of the imported function is written by the Windows loader.
What is the Import Table?
You can import all data of a table exported from a database using the EXPORT TABLE command to a database. Use the IMPORT TABLE command to do so. It is not possible to select specific column values with the IMPORT TABLE command; you can only do this with the IMPORT COLUMNS command.
What is export address table?
The only required array is the Export Address Table (EAT), which is an array of function pointers that contain the address of an exported function. An export ordinal is simply an index into this array (see Figure 3).
What is a PE image?
This specification describes the structure of executable (image) files and object files under the Windows family of operating systems. These files are referred to as Portable Executable (PE) and Common Object File Format (COFF) files, respectively.
What is IAT malware?
The IAT is a list if Windows functions that the malware will import, so if it needs to create a new process it can use the Windows API CreateProcessInternalW.
Where does the import address table come from?
This is a table of function pointers filled in by the windows loader as the dlls are loaded. When the application was first compiled, it was designed so that all API calls will not use direct hardcoded addresses but rather work through a function pointer.
Is the pointer table the same as the import table?
The pointer table can be accessed in several ways — either directly by a call to [pointer address] or by the “Import Lookup Table” and the “Hint/Name Table”. The structure and content of the import address table are identical to those of the import lookup table, until the file is bound.
What does the import directory table look like?
The import directory table consists of an array of import directory entries, one entry for each DLL to which the image refers. The last directory entry is empty (filled with null values), which indicates the end of the directory table.
Where do I find address table in WinDbg?
The OriginalFirstThunk points to the Import Name Table and the FirstThunk points to the Import Address Table. We can find these in WinDbg, but it may take a little detective work to do so.