Specifically I want to know what the data structure for the imports (idata) section looks like.
Specifically I want to know what the data structure for the imports (idata) section
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Specifically I want to know what the data structure for the imports (idata) section looks like.
The DLL file format is the same as that of EXE files, the PE (portable executable) format. You can get a copy of the specification from Microsoft. You can also try Wotsit for general file-format information.
Windows provides the ImageHlp API for working with executable files. The
LoadImagefunction looks like a good place to start.You should also take a look at the ‘Portable Executable File Format’ chapter of Undocumented Windows NT. It seems to describe how to use ImageHlp to get at various parts of a binary. I think the part you’re most interested in is on the fourth page, which describes the
IMAGE_DIRECTORY_ENTRY_IMPORTpart of the PE file.