Log in

View Full Version : IAT


wet behind the ears
April 13th, 2001, 17:10
Where in the PE header this import data supposed to be stored (.idata?)

All by chance, I found the correct IAT Start RVA and length and Revirgin gave me all the modules, IT_ADD added IT.bin. Now I have two .idata in my unpacked .exe. It works well but, I wonder isn't it possible to disassemble the .exe? May be I should use stg other than w32dasm?

Carpathia
April 13th, 2001, 18:41
http://carpathia.cjb.net/pe_format.zip

contains some of the more popular PE references.

[yAtEs]
April 25th, 2001, 07:00
Quote:
wet behind the ears (04-13-2001 07:10):
Where in the PE header this import data supposed to be stored (.idata?)


http://www.yates2k.co.uk/Import_tables.txt

The IAT is pointed to in each iids which is located at PE+80 PE=dword at 0x3Ch