abcdefghi019283
abcdefghi019283

Reputation: 105

Assembly - Are those imports valid functions?

When disassembling Portable Executables I realize that the import section often contains names like __imp_GetPixel instead of GetPixel directly (GetPixel is just an example here). Is there a reason why? Are they still referring to the same function? Is the extrn keyword in idata always referring to functions or can it also refer to constants?

Example file: enter image description here

Now, in the picture above it is pretty straight forward that those imports are functions. But sometimes it is not that clear(that is why I asked if only functions get imported):

enter image description here

Upvotes: 0

Views: 68

Answers (1)

IInspectable
IInspectable

Reputation: 51345

A PE image can import functions and data.

Upvotes: 1

Related Questions