Dumpbin output meaning below .dll import part

Question

Here is a part of what I got when run dumpbin .exe file.

  Section contains the following imports:

    KERNEL32.dll
                5A71E8 Import Address Table
                620468 Import Name Table
                     0 time date stamp
                     0 Index of first forwarder reference

                  458 SetErrorMode
                  2B9 GlobalFlags
                   64 CompareStringW
                  206 GetLocaleInfoW
                  26E GetSystemDefaultUILanguage
                  418 RtlUnwind
                  300 IsDebuggerPresent
                  304 IsProcessorFeaturePresent
                   B5 CreateThread
                  11A ExitThread
                  119 ExitProcess
                  217 GetModuleHandleExW
                  2D1 HeapQueryInformation
                  487 SetStdHandle
                  1F3 GetFileType
                  4F1 VirtualQuery
                  264 GetStdHandle
                  263 GetStartupInfoW

This part is under SECTION HEADER #2 ( .rdata name...) I don't know what is these lines under the line KERNEL32.dll mean? Thanks

score 2 · Accepted Answer · answered Mar 14 '17 at 18:46

2

458 SetErrorMode
2B9 GlobalFlags
 64 CompareStringW
206 GetLocaleInfoW

The right-hand column is the name of the function, the left-hand column is the index of the function in kernel33.dll's import table, in hexadecimal.

The 'W' suffix indicates that the function takes UTF-16 'Wide' strings, a 'A' suffix indicates that it takes ASCII, or other 8-bit string, according to the codepage settings. This includes UTF-8.

answered Mar 14 '17 at 18:46

CSM

1,232
1
8
12

Thanks. But what index mean here? and " 5A71E8 Import Address Table 620468 Import Name Table 0 time date stamp 0 Index of first forwarder reference" mean? Where do I find Import Address Table ? – chickensoup Mar 15 '17 at 01:32
@chickensoup The first number is the ordinal in the export address table of the dll you're referencing. I can send you code for a DLL loader if you want? I personally found the IAT & EAT a huge pain when I was learning about the PE format as well, I found it hard to find a detailed explanation. – user2073973 Jul 18 '17 at 08:24

Dumpbin output meaning below .dll import part

1 Answers1