calls are typically indirect – carry a virtual-call overheadWindows 8binary … .idata Import data section 9.idata contents Directory Table Directory entry: • DLL Name • ImportLookupTable offset • … … https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-idata-section 10 * Actually in section .rdata… .idata lib1: f1, f2, f3 lib2: g1, g2, g3 Windows Schematic Interface 11Linux symbol names 13lib1, lib2 f1, f2, f3, g1,g2,g3 … code data .dynamic .dynsim … code data .idata lib1: f1, f2, f3 lib2: g1, g2, g3 14Interposition • Overriding a symbol in one binary from another

reader(fname): ifile = open(fname, "rb") idata = ifile.read() # put in memory ifile.close() ibuffer = BytesIO(idata) # convert to stream try: doc = fitz.open("pdf", idata) # open and save a corrected c = doc.write(garbage = 4) # version in memory doc.close() doc = idata = None # free

------------------- def reader(fname, password = None): idata = open(fname, "rb").read() # read the PDF into memory and ibuffer = BytesIO(idata) # convert to stream if password is None: try: return

rights reserved. Dump of file jbackup.exe File Type: EXECUTABLE IMAGE Summary 5000 .data 1000 .idata 1000 .rdata 5000 .text 拿它来观察DOS 程序，则得到这样的结果： 31 C:\UTILITY>dumpbin /summary dsize.exe Microsoft 加载器将必要的码加载到上述地址空间中，包括App.exe 的程序、资料，以及 所需的动态联结函数库（DLLs）。加载器如何知道要加载哪些DLLs 呢？它 们被记录在可执行文件（PE 文件格式）的.idata section 中。 5. 系统为此进程建立一个执行线程，称为主执行线程（primary thread）。执行线程才是 CPU 时间的分配对象。 6. 系统调用C runtime 函数库的Startup

([]string, error) { 247 pe64 := f.Machine == IMAGE_FILE_MACHINE_AMD64 248 ds := f.Section(".idata") 249 if ds == nil { 250 // not dynamic, so no libraries 251 return nil, nil