Glossary
Import Address Table (IAT)
A table inside a PE binary filled by the Windows loader with the runtime addresses of imported DLL functions.
The Import Address Table (IAT) is a data structure in PE Format executables. At load time, the Windows loader resolves each imported function name (or ordinal) to its actual in-memory address and writes it into the IAT. Code in the binary then calls imported functions by dereferencing their IAT slot — e.g., CALL [IAT+offset]. Packers often destroy or encrypt the IAT to defeat static analysis, and API hooking tools overwrite IAT entries to redirect calls. Reconstructing a wiped IAT (using tools like Scylla) is a standard step in manual unpacking.