IAT and eat

Iat-import Address Table

The operation of a common PE file often requires importing multiple library files, and how to find the correct entry of functions in the library file when the PE file is run is the guarantee that the program runs correctly. The IAT is a mechanism for providing such assurances.

The IAT is always a table with a table that stores the address of each library file function in memory.

As far as I understand it, the IAT corresponds to the image_import_descriptor structure, each of which represents a library, and each library corresponds to how many image_import_descriptor structures are required to load as many libraries as a iat,pe piece is properly run. The position of the struct can be found by the optional head datadirectory[1] member element in the PE header.

The image_impoter_descriptor structure consists of five members. The first member is a union: The value of originalfirstthunk is generally given, which is the address of int, and an int (Import name table) is a table that stores the name of the library file function.

The second member is a timestamp. A third member is Forwarderchain. The fourth member is name, which stores the address of the library name character array. The fifth member is Firstthunk, which stores the address of the IAT table.

When the PE file is loaded into memory:

The first step:

The PE loader reads the value of the struct member, the name member finds the library name, and then loads the library file into memory.

Step Two:

The PE loader reads the Originalfirstthunk value to obtain an int address, and then reads the value of the int in turn, taking the address of the function according to the function's label.

Step Three:

The address of the IAT is obtained based on the value of Firstthunk, and the previous step gets the address into the IAT for storage.

The question here is: int should be a set of pointers to objects that are structured: image_import_by_name, which stores the names and labels of functions. The question is: When is the data of this struct, which exists when the PE file source program is compiled, or when the library file is loaded.

Eat-export Address Table

The structure of the Eat is image_export_descriptor, and the location information is stored in the optional header datadirectory[0].

General PE file This value should be 0, which means that the table entry does not exist and only the library file will contain the table entry.

Struct members include eigenvalues, timestamps, version information, and so on. The important member is name, which stores the name of the library file, where the base stores the function designator, and Numberoffunctions stores the number of functions; Numberofnames stores the number of function names (typically the two are the same) The first address of an array of addressoffunctions function addresses; the first address of an array of addressofnames function names; adressofnameordinals, which stores the address information of the function designator.

Summarize

Normal PE file through the IAT table to properly call the library file function, the library file through the Eat table to the function of the correct entry to inform the normal PE file.

The acquisition of an IAT address is actually obtained using the GetProcAddress () API from the library file via the name or designator provided by int, and the GetProcAddress () API is the address obtained by accessing the Eat table.

IAT and eat