.EXE File Format – Bound imports

Windows executable (PE32)

A bound program has the addresses of its imported functions written into its import address tables in advance, for particular versions of the DLLs, by BIND.EXE or the linker’s /BIND option. The bound import table, at data directory 11, says which versions: the time stamp of each DLL the program was bound to. It is the newer of the two ways to record binding; see Binding. 63 of the PE files examined for this site had one.

Bound import descriptors

The table usually lies in the headers, after the section table, so data directory 11 gives an offset that is also an RVA below the first section. It is a list of IMAGE_BOUND_IMPORT_DESCRIPTOR, 8 bytes each, ending with one that is all zero; the DLL names follow the list.

OffsetSizeTypeFieldMeaning
04u32TimeDateStampThe time stamp of the DLL the imports were bound to, from its COFF header.
42u16OffsetModuleNameThe offset of the DLL’s name from the start of the bound import table.
62u16NumberOfModuleForwarderRefsThe number of forwarder references that follow this descriptor.

At load time, if a bound DLL’s time stamp matches and it loads at its preferred address, the prebound addresses in the import address table are used as they are. Otherwise the loader resolves the imports from the lookup table, as for an unbound file.

Forwarder references

A DLL may forward some of its exports to another DLL, as KERNEL32.dll forwards some functions to NTDLL.dll. A prebound address for such a function is really in the second DLL, so its time stamp must match too. Each forwarder reference, IMAGE_BOUND_FORWARDER_REF, follows its descriptor:

OffsetSizeTypeFieldMeaning
04u32TimeDateStampThe time stamp of the DLL forwarded to.
42u16OffsetModuleNameThe offset of its name from the start of the bound import table.
62u16Reserved0.

The explorer shows each descriptor with its forwarder references after it, and the names after the list.