IAT

ypedef struct _IMAGE_IMPORT_DESCRIPTOR {  
    union {  
        DWORD   Characteristics;            // 0 for terminating null import descriptor  
        DWORD   OriginalFirstThunk;         // RVA to original unbound INT(Import Name Table) (PIMAGE_THUNK_DATA)  
    } DUMMYUNIONNAME;  
    DWORD   TimeDateStamp;                  // 0 if not bound,  
                                            // -1 if bound, and real date\time stamp  
                                            //     in IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT (new BIND)  
                                            // O.W. date/time stamp of DLL bound to (Old BIND)  

    DWORD   ForwarderChain;                 // -1 if no forwarders  
    DWORD   Name;                           //library name string address(RVA)
    DWORD   FirstThunk;                     // RVA to IAT(Import Address Table) (if bound this IAT has actual addresses)  
} IMAGE_IMPORT_DESCRIPTOR;  
typedef IMAGE_IMPORT_DESCRIPTOR UNALIGNED *PIMAGE_IMPORT_DESCRIPTOR;  

typedf struct _IMAGE_IMPORT_BY_NAME{
    WORD    HINT;            //ordinal
    BYTE    Name[1];         //function  name  string 
}IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

导入表描述符

    typedef struct _IMAGE_THUNK_DATA32 {  
        union {  
            DWORD ForwarderString;      // PBYTE   
            DWORD Function;             // PDWORD  
            DWORD Ordinal;  
            DWORD AddressOfData;        // PIMAGE_IMPORT_BY_NAME  
        } u1;  
    } IMAGE_THUNK_DATA32;  
    typedef IMAGE_THUNK_DATA32 * PIMAGE_THUNK_DATA32;