加载器如何找到 dll 中导出函数的准确位置？
我在 PEView 中打开一个二进制文件。二进制文件的 .rdata 部分下有一个名为“导入名称表”的表。该表显示了从不同 DLL 导入的函数，但该表中有一个名为 DATA 的字段。该字段具有以下值，您可以在照片中看到它们。例如，GetCurrentProcessID 为 2596。
从Windbg角度查看上述信息：
但是当我们的二进制文件完全加载到内存中时，这个值 (2596) 会随着另一个 VA 的变化而变化您可以在下面的照片中看到。
但是，我根本不明白这个值是什么？以及加载程序如何使用提示值来查找 DLL 中导出函数的确切位置？有人可以实际地逐步解释这一点吗（例如，在windbg中？）。
I open a binary in the PEView. There is a table which is called Import Name Table under .rdata section of the binary. This table show me imported functions from different DLLs but there is a field in this table which is called DATA. This field has following values which you can see them in the photo. for example 2596 for GetCurrentProcessID.
View of the above information from Windbg perspective:
But when our binary get loaded in the memory completely, this value (2596) changed with another VA which you can see in the following photo.
However, I couldn't understand what this value is at all? and also How hint value is used by loader to find out exact location of an exported function from a DLL? Could some explain this step by step practically (for example, in windbg?).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
PE 文件包含两个导入列表：查找表和地址表 (IAT)。这些的 RVA 位于
IMAGE_IMPORT_DESCRIPTOR中。从技术上讲，我相信只允许有一个表，如果我没记错的话，旧的 Borland 工具可能会这样做。导入不能仅与一张表绑定。查找表条目是指针大小的值，其中包含指向前向的序号或 RVA 或指向提示和函数名称的 RVA。 IAT 条目包含相同的值，或者如果绑定，则为实际地址。
当 PE 文件被加载时，加载器将 IAT 中的条目替换为导入函数的真实地址。另一个表没有改变。
加载器有 4 种解析导入函数地址的方法：
当您看到像
call DWORD PTR [_imp_Xyz]这样的反汇编时，您正在查看调用导入函数的代码，并且实际地址是从 IAT 读取的。A PE file contains two lists of imports, the lookup table and the address table (IAT). The RVAs to these are in
IMAGE_IMPORT_DESCRIPTOR. Technically I believe it is allowed to only have a single table, older Borland tools might do this if I remember correctly. The imports cannot be bound with only one table.The lookup table entries are pointer sized values that contains the ordinal or a RVA to a forward or a RVA to the hint and function name. The IAT entries contain the same values, or if bound, the actual address of the exported function.
When the PE file is loaded the loader replaces the entries in the IAT with the real address of the imported function. The other table is not changed.
The loader has 4 ways of resolving the imported function addresses:
When you see disassembly like
call DWORD PTR [_imp_Xyz]you are looking at code that calls an imported function and the real address is read from the IAT.