Label: IAT
IAT (Import Address Table) is a structure inside Windows PE files. It stores the addresses of imported DLL functions used by an application. During program startup, the Windows loader resolves imported functions and writes their real memory addresses into the IAT. The application then calls external APIs through these table entries. This mechanism allows dynamic linking between executables and DLL libraries at runtime. The Import Address Table is a fundamental part of the Portable Executable format. It is widely analyzed in reverse engineering, malware research, and low-level debugging. Many API hooking techniques work by replacing function pointers inside the IAT. Corrupted import tables can cause application startup failures or crashes.
Understanding the IAT is important for PE analysis, Windows internals, and API interception techniques.
A hook on a function call via modifying an import table
