3

Can anyone explain the structure of IMAGE_THUNK_DATA?

I just know it has 4 elements, but I want the explanation of these elements.

A.bee
  • 502
  • 5
  • 16
  • 1
    You might find https://reverseengineering.stackexchange.com/q/13385 useful. It has a structure with named members for this PE section. Also have you search around? Did https://win32assembly.programminghorizon.com/pe-tut6.html not answer your question? – Tomáš Hübelbauer Apr 15 '17 at 07:28
  • 1
    Thanks. Yes I saw that, but it didn't explain it. The first link is ok. thanks – A.bee Apr 15 '17 at 09:47

1 Answers1

2

IMAGE_THUNK_DATA is defined like so:

typedef struct _IMAGE_THUNK_DATA {
    union {
        uint32_t* Function;             // address of imported function
        uint32_t  Ordinal;              // ordinal value of function
        PIMAGE_IMPORT_BY_NAME AddressOfData;        // RVA of imported name
        DWORD ForwarderStringl              // RVA to forwarder string
    } u1;
} IMAGE_THUNK_DATA, *PIMAGE_THUNK_DATA;

The comments should explain it well enough

GuidedHacking
  • 3,628
  • 1
  • 9
  • 59