calls are typically indirect – carry a virtual-call overheadWindows 8binary … .idata Import data section 9.idata contents Directory Table Directory entry: • DLL Name • ImportLookupTable offset • … … https://learn.microsoft.com/en-us/windows/win32/debug/pe-format#the-idata-section 10 * Actually in section .rdata… .idata lib1: f1, f2, f3 lib2: g1, g2, g3 Windows Schematic Interface 11Linux symbol names 13lib1, lib2 f1, f2, f3, g1,g2,g3 … code data .dynamic .dynsim … code data .idata lib1: f1, f2, f3 lib2: g1, g2, g3 14Interposition • Overriding a symbol in one binary from another

reader(fname): ifile = open(fname, "rb") idata = ifile.read() # put in memory ifile.close() ibuffer = BytesIO(idata) # convert to stream try: doc = fitz.open("pdf", idata) # open and save a corrected c = doc.write(garbage = 4) # version in memory doc.close() doc = idata = None # free

------------------- def reader(fname, password = None): idata = open(fname, "rb").read() # read the PDF into memory and ibuffer = BytesIO(idata) # convert to stream if password is None: try: return

([]string, error) { 247 pe64 := f.Machine == IMAGE_FILE_MACHINE_AMD64 248 ds := f.Section(".idata") 249 if ds == nil { 250 // not dynamic, so no libraries 251 return nil, nil