Can anyone please explain me this:

First, we look at the last value of the Optional Header, Data Directories, the Import Directory RVA value. This value gives us the address of the Import table when the file is loaded into memory. For example, the program is installed at the 0x0040000 address of the memory, our Import Directory is located at the 0x004< ImportDirectoryRVA >. But how can we find this table in the file (file offset )?

Source: https://onlyf8.com/pe-format Another source that uses the same method: https://www.ired.team/miscellaneous-reversing-forensics/windows-kernel-internals/pe-file-header-parser-in-c++

Then they provide a way to resolve the address of the IDT. However, what I don't understand.. why do they not add the RVA of the IDT to the imagebase of the process in memory? I mean.. when you look at the data directories section of the optional header, I see this:

enter image description here

Could anyone please explain my why it is not sufficient to add the RVA of the IDT to the ImageBase to locate the IDT in memory (why do we first need to resolve the section etc.)?

  • The goal of the section you're reading is "how can we find this table in the file?" Your question "locate the IDT in memory" is different. "imagebase of the process in memory" is meaningless when there is no process running (static analysis)
    – Ben Voigt
    Jun 20 at 23:38
  • Okay thank you that makes sense, but is there an added value in this case of static analysis , you could load the sample into memory without executing it, just to understand it (the import address table in memory provides more information than static analysis, although with static analysis the binary is disassembled, which can be useful) Jun 21 at 7:28


You must log in to answer this question.

Browse other questions tagged .