How we can get Hint in IMAGE_IMPORT_BY_NAME STRUCT in PE file?

Question

I am trying to write python script to extract information from import table. I managed to acquire function names imported by each dll. However I am not sure how I could access Hint. Any suggestion?

Answer 1

I'm going to assume you have a pointer to an IMAGE_THUNK_DATA structure for a 32-bit module (or IMAGE_THUNK_DATA64 for a PE32+) since you are already enumerating the names, so we'll just start by covering the bases from there. I'll also assume you are dealing with 32-bit modules, since you haven't specified otherwise.

The IMAGE_THUNK_DATA array is just an array of DWORDs and each DWORD represents an imported function. To know that a function is imported by name instead of ordinal, you must check that the highest bit is NOT set in the DWORD (i.e. 0x80000000).

1> If the high-bit is set, the value of the DWORD ANDed with 0xFFFF (just taking the low WORD) is the ordinal (and is also the "hint" value). The function is therefore imported by ordinal and there is no name available.

2> If the high-bit is not set, the whole DWORD is an RVA (pointer to memory image, without the base) to a IMAGE_IMPORT_BY_NAME structure. If you are reading from the file image, you'll have to convert the RVA to a file offset. I'll also assume you are already doing this, otherwise you wouldn't have the imported function names. The IMAGE_IMPORT_BY_NAME structure is defined as follows in winnt.h:

typedef struct _IMAGE_IMPORT_BY_NAME {
    WORD    Hint;
    BYTE    Name[1];
} IMAGE_IMPORT_BY_NAME, *PIMAGE_IMPORT_BY_NAME;

NOTE: The BYTE designated at Name of course only marks the beginning of the character array of the imported function name as the name can be larger than one character.

The first WORD is the hint, which you must be skipping over if you already have the name. Do you a snippet of the code you can show that you are having a problem with?