CODEWITHSUNDEEP
windowsexecutableportable-executable
5k1zk17
5k1zk17

Reputation: 389

Duplicate import entries in PE file

I am doing some bulk analytics on PE files, while parsing the import table of a PE file, I'm finding that many PE files import duplicate entries for a given DLL... why is this? what does this functionally provide?

For instance, a dump of example.exe import table shows:

Kernel32.dll User32.dll blah.dll Kernel32.dll Kernel32.dll User32.dll shell32.dll

Thanks in advance.

Upvotes: 2

Views: 429

Answers (1)

Geoffrey R.
Geoffrey R.

Reputation: 2116

Maybe the PE that you're analysing has been patched to import additional functions, since most of binaries have their Import Address Table quite packed so adding an entry into an existing module is fairly impossible.

Upvotes: 1

Related Questions