Import table in PE (.exe)

Question

I found a pointer for the "Import Table" field. The size is 8 bytes and is divided into virtual address and size. However, the value in the Virtual Address field is large and misleading my efforts to retrieve any location information for entries related to the import table. A value indicating the offset if the file (.exe) ends before reaching the desired offset.

Answer 1

The RVA (relative virtual address) of the import directory in the directory table must be valid. Perhaps your conversion to physical displacement does not work. Of course, this is done by going through the partition table to find the containing section. Then subtract this section starting the RVA from the target RVA. Then just add the physical section offset to this result. This will give you a position in the import directory file. Conversions with and from RVA may be necessary often if you are working with a file on disk. If you are working with an image in memory, sometimes the protection utilities modify or destroy parts of the PE header in memory to restrain dumping.

Once you get into the import directory, you still have something to work on. A quick Google revealed a better explanation than I probably will write here: http://sandsprite.com/CodeStuff/Understanding_imports.html

I am the author of now the classic PECompact, PEBundle (now discontinued) and other utilities for working with PE.