I open a binary in the PEView. There is a table which is called Import Name Table under .rdata section of the binary. This table show me imported functions from different DLLs but there is a field in this table which is called DATA. This field has following values which you can see them in the photo. for example 2596 for GetCurrentProcessID.
View of the above information from Windbg perspective:
But when our binary get loaded in the memory completely, this value (2596) changed with another VA which you can see in the following photo.
However, I couldn't understand what this value is at all? and also How hint value is used by loader to find out exact location of an exported function from a DLL? Could some explain this step by step practically (for example, in windbg?).
A PE file contains two lists of imports, the lookup table and the address table (IAT). The RVAs to these are in IMAGE_IMPORT_DESCRIPTOR
. Technically I believe it is allowed to only have a single table, older Borland tools might do this if I remember correctly. The imports cannot be bound with only one table.
The lookup table entries are pointer sized values that contains the ordinal or a RVA to a forward or a RVA to the hint and function name. The IAT entries contain the same values, or if bound, the actual address of the exported function.
When the PE file is loaded the loader replaces the entries in the IAT with the real address of the imported function. The other table is not changed.
The loader has 4 ways of resolving the imported function addresses:
When you see disassembly like call DWORD PTR [_imp_Xyz]
you are looking at code that calls an imported function and the real address is read from the IAT.