Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data Directories, the Import Directory RVA value. This value gives us the address of the Import table when the file is loaded into memory. For example, the program is installed at the 0x0040000 address of the memory, our Import Directory is located at the 0x004< ImportDirectoryRVA >. But how can we find this table in the file (file offset )?
Source: https://onlyf8.com/pe-format Another source that uses the same method: https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/pe-file-header-parser-in-c++
Then they provide a way to resolve the address of the IDT. However, what I don't understand.. why do they not add the RVA of the IDT to the imagebase of the process in memory? I mean.. when you look at the data directories section of the optional header, I see this:
Could anyone please explain my why it is not sufficient to add the RVA of the IDT to the ImageBase to locate the IDT in memory (why do we first need to resolve the section etc.)?