IatDirectory Class Reference

Class that handles the Import Address Table (IAT). More...

#include <IatDirectory.h>

List of all members.

Public Member Functions
void	addAddress (dword dwValue)
	Adds another address to the IAT.
dword	getAddress (dword dwAddrnr) const
	Retrieve the value of a field in the IAT.
unsigned int	numberOfAddresses () const
	Returns the number of fields in the IAT.
int	read (const std::string &strFilename, unsigned int dwOffset, unsigned int dwSize)
	Reads the Import Address Table from a PE file.
void	rebuild (std::vector< byte > &vBuffer) const
void	removeAddress (dword dwAddrnr)
	Removes an address from the IAT.
void	removeAll ()
	Empties the IAT.
void	setAddress (dword dwAddrnr, dword dwValue)
	Change the value of a field in the IAT.
unsigned int	size () const
	Returns the size of the current IAT.
int	write (const std::string &strFilename, unsigned int uiOffset) const
	Writes the current IAT to a file.
Private Attributes
std::vector< dword >	m_vIat
	Stores the individual IAT fields.

---

Detailed Description

Class that handles the Import Address Table (IAT).

This class can read and modify the Import Address Table of a PE file.

---

Member Function Documentation

void addAddress (  dword  dwValue  )

Adds another address to the IAT. Adds another field to the IAT. Parameters: dwValue  dwValue of the new field.

dword getAddress (  dword  dwAddrnr  )  const

Retrieve the value of a field in the IAT. Returns the dwValue of a field in the IAT. Parameters: dwAddrnr  Number identifying the field. Returns: dwValue of the field.

unsigned int numberOfAddresses (   )  const

Returns the number of fields in the IAT. Returns the number of fields in the IAT. This is equivalent to the number of imported functions. Returns: Number of fields in the IAT.

int read (  const std::string &  strFilename, unsigned int  dwOffset, unsigned int  dwSize )

Reads the Import Address Table from a PE file. Reads the Import Address table from a file. Parameters: strFilename  Name of the file. dwOffset  File offset of the IAT (see #PeFile::PeHeader::getIDIatRVA). dwSize  Size of the IAT (see #PeFile::PeHeader::getIDIatSize).

void rebuild (  std::vector< byte > &  vBuffer  )  const

Rebuilds the complete Import Address Table. Parameters: vBuffer  Buffer where the rebuilt IAT will be stored. Here is the call graph for this function:

void removeAddress (  dword  dwAddrnr  )

Removes an address from the IAT. Removes an address from the IAT. Parameters: dwAddrnr  Number identifying the field.

void removeAll (   )

Empties the IAT. Delete all entries from the IAT.

void setAddress (  dword  dwAddrnr, dword  dwValue )

Change the value of a field in the IAT. Updates the dwValue of a field in the IAT. Parameters: dwAddrnr  Number identifying the field. dwValue  New dwValue of the field.

---

The documentation for this class was generated from the following files:

• IatDirectory.h
• IatDirectory.cpp

---