Wednesday, December 11, 2013

Import Address Table (IAT)

IAT is a call table (an array of routine addresses) of user mode modules.  Most executables have one or more IAT used to store the addresses of library routines that the module import from DLLs.

When the module is compiled with load-time dynamic linking option, the linker will take the addresses of each exported routine and place into an IAT specific to each DLL.  When the application is loaded, the system will map the DLL into the address space and call the DLL entry point (DllMain with DLL_PROCESS_ATTACH argument).

Run-time dynamic linking does not rely on IAT.  The module will specify the DLL and routine name at run time using LoadLibrary() and GetProcAddress() calls.  One advantage of run-time dynamic linking is that the module can recover in case the DLL is not found.


No comments: