Hi all:

I'm making a program to dump the import table of the PE files, but i have found a problem. At offset PE + 80 there is the addres of the import table and in the next DWORD i thought there was the size of the import table. This is only true for the programs compiled with borland products, in the microsoft ones there only appeares the size of the array of Image import decriptors. I've searched in internet without luck (someone will be thinking in sending me to the searching lores page ). Hope there's someone that can give me an idea of how to get this size (the idata section isn't always called like this ).

Sorry about my low english level, and thanks .

Hi Remi,

Why dont you just parse the Import_Directory Table itself, until the end of it... it should be ended with 10h 00 bytes if i am not wrong...

I guess it is the most foolproof way, though slightly more works to do ...

regards,
crUsAdEr

14h 00 bytes

bye
ZaiRoN

Hi crUsAdEr:

I will have to do something like this at the end. The problem is that i want't to show the import tables raw hex dump but trying to difference between the diferent sections in it. If there isn't any diferent way to do it, i will take the offset pointed by the last pimage_thunk_data field of the import directory table (wich points to the last array of imported functions), and once found where does this array finish, sub this offset to the offset where the import table starts to get it's size.

I'll have to go back in the work i've already done anyway, also calculating the size of the import directory, cause i have used a more direct aproach than searching for zeros at the dll's name field. So i will keep trying if that is what Lenin said, I would't like to become a Stalin....

Thanks !