hello, 2 questions:
this is a sample of the pointer to the import table
0820 0000 2800
2008 should be the address of the table and 28 its size?
i don't understand how i can find these informations with this line

2nd question:
the import table:

8 ......0 ......
....F ... ......
................
8 ......u.ExitPr
ocess.KERNEL32.d
ll

where do I have to put the function i want ?
say USER32!MessAgeBoxA
Directly at the end? And then how can I calculate the changes i have to do to the import table description?

Any link or idea would be welcome
regards

There are many factors involved when manipulating PE files, you need to take a good read of a PE specification document before you can understand this in a good way.

If you have problems interpreting these fields, you probably want a tool that does it for you.

Take a look at this thread:
http://www.woodmann.com/forum/showthread.php?t=6347

Take a look at the thread named 'Changing notepad's background color' in the Mini Project Forum. I explain how to add dlls and import entries there.

Peres