title: Import Table (IT) vs Import Address Table (IAT)
body: <p>I've been trying to parse/display the information in the Import Address Table (IAT) of a process after it is loaded and running. I understand API calls in programs jump to the relevant point in the IAT, which then jumps to the actual function in the loaded DLL's.</p>
  
  <p>Is it correct that the IAT can be found by reading the PE header and following the OptionalHeader.DataDirectory[1] pointer, to the array of IMAGE_IMPORT_DESCRIPTORs. Then following the <em>FirstThunk</em> pointers. Whereas the  <em>OriginalFirstThunk</em> pointers here, will give you the original Import Table (IT)?</p>
  
  <p>I have also tried following the OptionalHeader.DataDirectory[12] pointer in the PE header, but this was even less successful.</p>
  
  <p>I've been testing this by trying to parse this structure for notepad.exe (32bit), using ReadProcessMemory from another process. </p>
  
  <p>Here's the rough C-psuedocode for what I'm doing:</p>
  
  <pre><code>char buf[128];
  
  // get first import descriptor
  readMemory(&amp;import, procImgBase + DataDirectory[1].VirtualAddress, sizeof(IMAGE_IMPORT_DESCRIPTOR));
  
  // get dll name 
  readMemory(buf, import.Name + procImgBase, 127);
  printf("libname: %s\n", buf);
  
  // get first function name
  DWORD iltAddress = 0;
  readMemory(&amp;iltAddress, import.FirstThunk + procImgBase, 4);
  readMemory(buf, iltAddress + procImgBase, 127);
  printf("fname: %s\n", libName + 2); // &lt;-- the +2 for the 2byte 'hint' of import lookup table entries
  </code></pre>
  
  <p>If, on the 3rd to last line, i replace it with import.OriginalFirstThunk instead of FirstThunk, it will print everything as expected. I must be missing something conceptually, and so I was wondering if anyone could clarify what this is, for me?</p>
  
  <p>Many thanks!</p>