I have been trying to understand how to reconstruct Imports in packed/encrypted programs.

Tuturials like +Tsehp's and others keep talking about IT and IAT.
Can any one explain me what is the diference ?

Is it that IAT is the Image Descriptor Table ?

Thanks

Hi Ivanov,

Here's some little explaination from a Tutorial from myself


- Import Lookup Table (ILT)

An RVA (Relative Virtual Address) to an Table that contains RVA's to the names of the API's that belong to the *.DLL
The "Base Addresses" of the API's are not placed in this Table but in the IAT.
The Import Lookup Table RVA can be left empty.

- Time/Date Stamp

The Time/Date the IT was created by the Compiler.
The Time/Date Stamp RVA can be left empty.

- Forwarder Chain

Index of first forwarder reference.
The Forwarder Chain RVA can be left empty.

- Name (Of *.DLL or *.EXE)

This is an RVA that points to the Name of an *.DLL or *.EXE where this "Import Directory Table" belongs to.
The Name doesn't have to contain .DLL or .EXE (For example it can be KERNEL32).
The Name (Of *.DLL or *.EXE) RVA cannot be left empty (It can be left empty but then it means the IT has finished, because there are no more *.DLL or *.EXE to be Imported .

- Import Address Table (IAT)

This is an RVA that points to an Table almost identical to the "Import Lookup Table".
But the difference is that in this Table the RVA's to the API's will be replaced with the corresponding "Base Addresses" of the API's.
The Import Address Table RVA cannot be left empty.


Try to find some document about the IT
Hope this helps.
Cya...

CoDe_InSiDe