When does the PE file format IAT function addresses get set

Question

I google'd a bit and read http://en.wikipedia.org/wiki/Portable_Executable but i can't seem to find when the Import adress table addresses are written. Does it happen on compilation? Or when the executable is ran?

Answer 1

It happens during runtime. Read this.

Answer 2

The whole point of the IAT is to allow a PE image to be loaded at an arbitrary location in the address space at run time. Since the base address is not known until run time, the IAT cannot be populated at compile time. This means that the addresses are set when the PE image is loaded into memory at run time.

Matt Pietrek's MSJ columns about the PE format are excellent references.