IAT

[wet behind the ears]

Where in the PE header this import data supposed to be stored (.idata?)

All by chance, I found the correct IAT Start RVA and length and Revirgin gave me all the modules, IT_ADD added IT.bin. Now I have two .idata in my unpacked .exe. It works well but, I wonder isn't it possible to disassemble the .exe? May be I should use stg other than w32dasm?

[Carpathia]

http://carpathia.cjb.net/pe_format.zip

contains some of the more popular PE references.

[[yAtEs]]

Quote:

wet behind the ears (04-13-2001 07:10): Where in the PE header this import data supposed to be stored (.idata?)

http://www.yates2k.co.uk/Import_tables.txt

The IAT is pointed to in each iids which is located at PE+80 PE=dword at 0x3Ch