The Data directory array points to the other optional headers that might be included in the executable and are not necessary included in every application.
It includes 16 entries following this format:
- Address: This points to the beginning of the header in memory (relative to the start of the file).
- Size: This is the size of the header.
| Address | Size |
The Data directory array includes many different values; not all of them are that important for malware analysis, but some of the important blocks to mention are as follows:
- Import table: This represents the code functions (or APIs) that this program doesn't include but wants to import from other executable files or libraries of code (or DLLs).
- Export table: This represents the code functions (or APIs) that this program includes in its code and is willing to export and allow other applications to use, rather than rewrite them from scratch.
- Resource table: This is always located at the start of the resource section...
