IAT Resolution

How the loader patches the Import Address Table, bound imports, delay-load imports, forwarded exports, and the ways malware exploits the resolution process

IAT Resolution: What the Loader Does

Chapter 7 covered the IAT data structures (IMAGE_IMPORT_DESCRIPTOR, INT, IAT). Here we focus on the loader's resolution algorithm and its security implications.

The Resolution Algorithm

For each IMAGE_IMPORT_DESCRIPTOR in the Import Directory:
  1. Load the named DLL (DLL name at OriginalFirstThunk's Name field)
  2. For each entry in the INT (OriginalFirstThunk array):
     a. If high bit set → import by ordinal (value & 0x7FFF = ordinal)
     b. Else → import by name: pointer to IMAGE_IMPORT_BY_NAME
        - Read hint (2-byte guess at export ordinal table index)
        - If hint valid → try EAT[hint] directly
        - If name matches → use that address (fast path)
        - If name doesn't match → binary search ENT for name
     c. Write the resolved VA into the corresponding IAT slot
  3. IAT is now a table of live function pointers, ready to use

The caller's compiled code has a indirect CALL through the IAT slot — call [IAT+offset]. After resolution, that slot holds the actual function address. EDR hooks typically overwrite this slot (IAT hook) or the function prologue itself (inline hook) with a trampoline. Malware that resolves functions manually bypasses both.

Bound Imports

The loader resolves imports at every process launch, which adds startup latency for DLL-heavy executables. Bound imports are a pre-resolution optimization: the linker or post-processing tool computes the expected VA of each import (based on the DLL's preferred base) and writes these values directly into the IAT at build time.

At load time, the loader checks whether the bound addresses are still valid: if the DLL loaded at its preferred base and its timestamp matches the one recorded in the IMAGE_BOUND_IMPORT_DESCRIPTOR, the IAT is already correct and the loader skips resolution. When ASLR is active (which rebases DLLs away from their preferred base), bound imports are always invalid and the loader ignores them, resolving normally.

Delay-Load Imports

Some DLLs are only used in rare code paths. Loading them at startup wastes memory and time. Delay-load imports (stored in the Delay Import Directory, data directory index 13) defer loading until first use:

1. The linker generates a stub for each delay-loaded function
2. The stub's first call invokes __delayLoadHelper2 (from the CRT)
3. __delayLoadHelper2 calls LoadLibrary for the DLL, then resolves the function address
4. The stub's IAT slot is patched with the real address — subsequent calls go direct

Malware uses delay-load to evade static import analysis: a suspicious import (VirtualAllocEx, WriteProcessMemory) placed in the delay import table won't appear in the standard IDT and won't show up in naive import scanners.

Forwarded Exports

Some DLL exports don't actually live in the exporting DLL — they forward to another DLL. For example, many kernel32.dll functions forward to kernelbase.dll. When the loader encounters a forwarded export, it loads the target DLL and resolves the function there.

# Python: detect forwarded exports (forwarder string = non-code RVA)
import pefile

def list_forwarded_exports(path: str):
    pe = pefile.PE(path)
    if not hasattr(pe, 'DIRECTORY_ENTRY_EXPORT'):
        return
    for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
        if exp.forwarder_offset is not None:
            fwd = pe.get_string_at_rva(exp.forwarder_offset)
            print(f"  Ordinal {exp.ordinal}: {exp.name} -> {fwd.decode()}")

Malware IAT Techniques

Detection: IAT Integrity Check

"""
Detect IAT hooks by comparing live IAT entries to expected
addresses from the DLL's on-disk export table.
"""
import ctypes, ctypes.wintypes, pefile

OpenProcess = ctypes.windll.kernel32.OpenProcess
ReadProcessMemory = ctypes.windll.kernel32.ReadProcessMemory
PROCESS_VM_READ = 0x0010
PROCESS_QUERY_INFORMATION = 0x0400

def get_expected_function_va(dll_path: str, func_name: str, loaded_base: int) -> int:
    """Read DLL from disk, find export RVA, add actual loaded base."""
    pe = pefile.PE(dll_path, fast_load=True)
    pe.parse_data_directories()
    for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
        if exp.name and exp.name.decode() == func_name:
            return loaded_base + exp.address
    raise ValueError(f"Export {func_name} not found")

def read_iat_entry(pid: int, iat_va: int) -> int:
    """Read an 8-byte IAT slot from a target process."""
    hProc = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, 0, pid)
    buf = ctypes.c_uint64()
    read = ctypes.c_size_t()
    ReadProcessMemory(hProc, ctypes.c_void_p(iat_va), ctypes.byref(buf),
                      ctypes.sizeof(buf), ctypes.byref(read))
    ctypes.windll.kernel32.CloseHandle(hProc)
    return buf.value

def check_iat_hook(pid: int, pe_path: str, dll_path: str,
                   dll_loaded_base: int, func_name: str, iat_slot_va: int):
    live_ptr    = read_iat_entry(pid, iat_slot_va)
    expected_va = get_expected_function_va(dll_path, func_name, dll_loaded_base)
    if live_ptr != expected_va:
        print(f"[HOOK DETECTED] {func_name}")
        print(f"  IAT slot VA:   0x{iat_slot_va:016X}")
        print(f"  Live pointer:  0x{live_ptr:016X}")
        print(f"  Expected:      0x{expected_va:016X}")
        print(f"  Delta:         0x{abs(live_ptr - expected_va):X}")

Q & A