A problem I had with objdump

[Michael Hore]

Hello people,

I have just discovered a small deficiency in objdump when it is reading 
PE .exe files. Specifically, currently when objdump reads the import 
directory table (the one that lists each .dll to be imported) it looks at the 
"import lookup table" entry to discover which symbols to import. It ignores 
the "import address table" (the thunk table).

The problem is that I have a .exe that has 00000000 in the "import lookup 
table" field and only has a valid lookup table in the "import address table". 
According to specifications, from what I've read, the import address table 
should look identical to the import lookup table, except after it has been 
bound.

Here is a snippet of output from objdump, you can clearly see what I am 
talking about here:

The Import Tables (interpreted .data section contents)
 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 00110a40       00000000 00000000 00000000 00110a00 001109ec

        DLL Name: kernel32.dll

 00110a54       00000000 00000000 00000000 00110bf8 00110ce5

        DLL Name: user32.dll

As you can see, the entries for "hint table" are zero, and only the "first 
thunk" entry has a valid address. I have looked at the .exe file and 
confirmed that a valid hint table is indeed at this location.

Obviously since windows has no problems at all loading this file, it would be 
nice if objdump could also read it :).

For anyone curious about how such a beast as this file came about, it is 
mailmate.exe from an app called Express address@hidden v2.6. You can download a 
30 
day demo. I believe it was written in some kind of Delphi.