Hello and welcome to a new section in this new section, we are going to study the important address
table structure by studying Microsoft Paint Haider and analysis.
So Microsoft Paint.
Hey, there, the Windows and the not hate files contains the structure of the unified descriptor.
The entire descriptor is to date that structure that contains information and address tables and import
lookup tables.
Microsoft pages its location.
In this diagram on the left is your window in Kigali, he hit a foul, which I have open in bat plus
plus, and then I search for this structure called input descriptor.
And this is the structure.
And this is why it looks like you can see that, yeah, altogether.
Five members, the first member and union consisting of characteristics with an arena first dunk guy
with characteristic duties now unused.
Now aides using only the first dunk.
Then the second member is what time this time?
And then you have follow the change, you would name you and first don't give it.
So all these members are this important descriptor is intended to stall data relating to where to find
the API functions for any particular SFR.
So it is using the following we take a look at be back on the right who is open and I've loaded Microsoft
been into eBay and in here I click on the optional header and then I scroll down and there will be a
physical input directory and RV here the address.
So if I right click on this, I will come to this region of the file, which contains all the files
that I use and buy this Microsoft Paint and all of these details here.
I actually this structure.
So let's move on to the next slide and you be clear for you.
So now he's seen two files with the Andean Haitien, the left and May because I've been there, right?
But this time I think on important step and is now clearer, as you can see.
This part of the memory is actually the.
For advocacy.
And how these values, Xia refers to this structure, find rugby.
And then if you look at this one here, the first for vice e-cars now this tank.
One two three four four by.
And you know, the first tank is also found here we see through to a ship.
She's this.
And then the next four vice would be your time stamp, which is in this case.
And you can see a time stamp is on this.
And then the next member is your follow the chain, which is again.
Oh yes.
And as you see here in less.
And then the next member is your name, which is your friendly name for this out of a PDA.
So this is the offset there.
You will find a friendly name for this game.
So if you went actually went to this location, you can, you can see, will be able to see the name
of this.
Yeah, in the string section.
And then the last one is first tank.
So the last four here is offering two nine seven zero zero zero.
This is the offset to your first function.
Can I start in by this idea?
So and not be experts on this?
Yes.
And the tank member of Need It after the restaurant structure is pointing to the first function that
is is 640.
So this is how you read it.
So the same thing happens for the second part here and in blue.
The second part here refers to connectivity to Dan.
So maybe the if I see here is the zero three five eight are here and then this is this business.
If I have actually the first member and then the second member is timely STEM, which is this one again,
we have.
For baseball, yes.
And in baseball bats, an official holiday cheer.
Here and here, and then the next member is here.
NIM, which is here is four based here.
Also here.
And this is if you went to this, I certainly would be you would be able to see the name to to get out
and the last member is first sunk, which is the last four base here.
And this will be the offset to your first function that is supported by an artery to the head.
So this is how you understand this important descriptor.
Now what we mean, maybe see it put an address table refers to the first tank.
So the first time here is a pointer to the first function of the input address table.
And then the first time here is known as the look up table function and cut cable system.
So when the program first, he actually first starts.
The idea is empty, but the original first tank will have some data that will contain the that functions.
But he doesn't know the address, so he will use these hints here to try to look this address into the
first 10 down here.
So once all the addresses included, the first down, our Heidi would be fully loaded and contains all
the addresses for the functions.
So this how the process of resolving function in Haiti works.
All these numbers here are the hints.
That means is something like the ordinal, which we studied before the previous lesson where we have
all of these numbers corresponding to the function names.
So this actually offsets to the address of the function in memory.
So we use this the people order, we use.
This hints to try to locate the address of these functions in memory.
Once it's loaded, first time will contain the complete IED table with corresponding addresses for every
function.
So that's all for this video In the next video, we are going to do a practical walkthrough on how to
look at the the entire descriptor using a calculator program.
So I'll see you in the next few minutes.
VIDEO Thank you for watching.