Question

For 80x86 assembly language and computer architrcture

In terms of modules, define an export.

Which entry of the resource directory identifies the start of the export directory?

What is the role of the import table in dynamic linking?

What is the primary benefit of storing a precomputed import address into IMAGE_IMPORT_DESCRIPTOR.FirstThunk?

Answer 1

Answer is as follows :

a) In terms of modules, define an export.

Modules are declarative, the relationships between modules are specified in terms of imports and exports at the file level

Any declaration such as a variable, function, class, type alias, or interface can be exported by adding the export keyword.

b) Which entry of the resource directory identifies the start of the export directory

The following entry of resource directory identifies the start of export directory

_IMAGE_EXPORT_DIRECTORY

c) What is the role of the import table in dynamic linking

When the linker links the object files into a binary, each time a function from a library is called, it inserts a reference at that place to that function in the import table of a binary.

At runtime, the code in the system loads the libraries referenced in the import tables and then all the functions can be easily called, because each library is loaded into memory.

d) What is the primary benefit of storing a precomputed import address into IMAGE_IMPORT_DESCRIPTOR.FirstThunk?

It leads you to the position of the import table inside the file image. There is a container for each imported DLL, import descriptor, that embraces the address of first thunk and the address of original first thunk, the pointer to the DLL name.

The First Thunk refers to the location of the first thunk; the thunks will be initialized by the PE loader of Windows during the running of the program