title: How can I resolve the forwarded API from the IAT on PE?
body: <p>Hi I'm trying to make a Import table builder in python script just like MacT's Import Reconstructor.</p>
  
  <p>But I have a trouble to find out the method to get an original API information from the forwarded API.</p>
  
  <p>For instance, I got a "ntdll!RtlDecodePointer" from IAT but It's forwarded from the "kernel32!DecodePointer" and I have no ideas to find it out.</p>
  
  <p>Should I have to search through every single loaded modules' ForwarderChain in Import directory?</p>