Thunk table in import address table?

Question

What is a thunk table in relation to the import address table that's used in EXE files to import functions used in external DLLs?

Is this thunk table just a table containing 'Thunks' to other functions?

Answer 1

Thunks are a part of the Import table (IMAGE_DIRECTORY_ENTRY_IMPORT) and Delay Import Table (IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT). They are described http://msdn.microsoft.com/en-us/library/ms809762.aspx.

I'll look at my old source code and will post later a working code which dump both this tables inclusive binding information.

UPDATED:

Here is a code which I fond in one of my old program. It support only 32-bit PE, but can be easy modified to 64-bit. By the way you can see, that it dump also binding information.To test this bind the PE which you want to dump with respect of bind.exe (use for example, bind.exe -u -v Test.dll).

The code consist from about 1000 lines, so I could not post it here. I receive an error message

Oops! Your edit couldn't be submitted because:

• body is limited to 30000 characters; you entered 55095

So I placed it here: http://www.ok-soft-gmbh.com/ForStackOverflow/PEInfo.c. I hope the code will help you better as a long description.