I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in the Import Lookup/Name table and in the case of a name in the Hint/Name table. However, please take a look at this topic: https://stackoverflow.com/questions/42413937/why-pe-need-original-first-thunkoft
Can someone explain me the answer of "Anders" (I don't have enough points to add a comment in this topic? I don't understand this section in particular:
On a fresh unpatched version of Windows, all addresses of all functions in the base .DLLs (ntdll, kernel32, user32, etc) are known. Take shell32 for example, it links to kernel32!CreateProcess and the true address of CreateProcess can be stored directly in shell32. This is called import binding and lets the loader skip the step where it looks up all the addresses of the imported functions.
I think I understand it, but I'm not sure. What confuses me in particular is... the virtual addresses can only be resolved at runtime...? so what is the main difference between this approach and that of a statically imported function whose address is resolved when it is loaded into memory and stored in the IAT?
