I find lots of information about PE32 now (portable executable 32 bit format).
I have some code that I want to redirect some function linked to other DLLs (kernel32.dll CreateFileA for instance) ...
I know how to walk the headers and get to the import table and dump the contents; but the resolved address array that is used in PE32 is all NULL in the 64 bit version. I'd consider maybe it's empty because of delay linking? But they're ALL NULL. So where do import addresses get resolved to?
I figure NASM import directive sort of hides the implementation detail ;but maybe someone can share what the detail is to get the address for a function in another dll that has been linked to my current EXE or DLL.