Imports: How a PE Uses Other DLLs

A program calls functions in system DLLs (kernel32.dll,

ws2_32.dll, ...). The PE records what it needs so the loader can

wire it up.

• The Import Directory (a DataDirectory entry) points to an array of IMAGE_IMPORT_DESCRIPTOR — one per imported DLL.
• Each descriptor references two parallel arrays:
• INT (Import Name Table): the names/ordinals requested.
• IAT (Import Address Table): filled in by the loader with the real function addresses at load time.

At load time the loader walks each descriptor, resolves every name to an

address, and writes it into the IAT. Your code then calls through the IAT.