I realized I still don't understand how import .lib files (eg. kernel32.lib, user32.lib, etc.) work.

I understand .lib file is just a pack of .obj files. I presume import lib file is a series of .obj files, one for every functions that can be imported from DLL. I also presume this .obj file exports two symbols: __imp__FunctionName@XX (dword which will be placed in IAT) and _FunctionName@XX (jump to function pointed by that dword).

What I don't understand:
- How does linker know it is supposed to place that __imp__XXX symbol to IAT?
- How does linker know in which DLL file does that function reside?
- How would one build import .lib file using standard MS tools (compiler, lib.exe, etc.)? Of course I don't mean workaround by building the mimicking DLL (which also produces .lib), I mean building object files for every imported function and placing them together to a .lib.

> - How does linker know in which DLL file does that function reside?
It doesn't. You have to tell it.

Tyler: You are giving example of FASM "format PE" source, which doesn't use linker at all. I was asking about something different.

write file.def
[code]
LIBRARY DLL
EXPORTS
DllHelloWorld
[/code]

DLL is name of dll library
library export 1 function which have a name DllHelloWorld
and link with switch /DEF:file.def

So you mean how does it know in what static link(.lib, .a) file the function is in?

Well, for ld(Yes, I know, ld is for *nix. But it may give you an idea of how other linkers do it.), it has preconfigured directories it automatically searches when it can't find a function you're trying to link to.

There's a flag(-nostdlib) to tell it not to search said directories.

I don't know any more specifics than that, but I'm sure Google can help.

Nevermind, I found it. Objects in lib file use a sorting feature of linker ("sectionname$number", eg. ".idata$4") to build up import section. Very clever.

More here: http://www.microsoft.com/msj/0498/hood0498.aspx

However, it seems Microsoft has introduced some kind of "packed lib" format since that article was written. LIB files I have in latest Visual Studio don't contain full COFF objects, only some very short ones, without usual IMAGE_FILE_HEADER and IMAGE_SECTION_HEADERS. Section names are only found once/twice at the end of the LIB file. Anyone has any info about this?

It is a pity Microsofts own tools can't account for this and extract full object file from such LIB.