When does the PE file format IAT function addresses get set

I google'd a bit and read http://en.wikipedia.org/wiki/Portable_Executable but i can't seem to find when the Import adress table addresses are written. Does it happen on compilation? Or when the executable is ran?

Answers


It happens during runtime. Read this.


The whole point of the IAT is to allow a PE image to be loaded at an arbitrary location in the address space at run time. Since the base address is not known until run time, the IAT cannot be populated at compile time. This means that the addresses are set when the PE image is loaded into memory at run time.

Matt Pietrek's MSJ columns about the PE format are excellent references.


Need Your Help

ExtJs add panel as tab item

javascript user-interface extjs tabs

I have a setup where the tab is expected to be loaded based on user selection of an item from a left panel tree. My objective is to load only the relevant items as per the user selection to a part...

Direct download from Google Drive using Google Drive API

java google-drive-sdk

My desktop application, written in java, tries to download public files from Google Drive. As i found out, it can be implemented by using file's webContentLink (it's for ability to download public ...