idata section in PE file not found

[Philipp Huber]

hi!

though analyzing an exe file that uses several dlls and imported functions i
am not able to find a idata section within the file.

is there any other way to determine which dlls are used by the exe file
programatically?

thanks, philipp

[Tim]

Phillip, take a look at my answer re: writing a custom debugger for your
original post on 9 July 2004.
While this may sound difficult its not too bad, just a bit time consuming.
But before you embark on this, check out the privileges needed to debug a
process - if I recall correctly, if you start the process your self, then
you do not need special privileges, only if you want to debug a process
someone else has started.

Regards,
- Tim

Post by Philipp Huber
hi!
though analyzing an exe file that uses several dlls and imported functions i
am not able to find a idata section within the file.
is there any other way to determine which dlls are used by the exe file
programatically?
thanks, philipp

[David Crow [MCSD]]

Look at the Section Table. It contains an array of IMAGE_SECTION_HEADERs.
When iterating through this array, look for one whose Name member is
".idata". The other members in that structure indicate where the .idata
section starts.

Post by Philipp Huber
hi!
though analyzing an exe file that uses several dlls and imported functions i
am not able to find a idata section within the file.
is there any other way to determine which dlls are used by the exe file
programatically?
thanks, philipp

[Philipp Huber]

Post by David Crow [MCSD]
Look at the Section Table. It contains an array of IMAGE_SECTION_HEADERs.
When iterating through this array, look for one whose Name member is
".idata". The other members in that structure indicate where the .idata
section starts.

That's what i have been trying. The curious thing is, that there is no idata
section - the only section headers i am able to find are
.text, .rdata, .data and .rsrc. The number of sections within the
IMAGE_FILE_HEADER is also four.
Iterating through the array gives exactely the mentioned section names.

Any other ideas?

Thanks, Philipp