windows - Duplicate import entries in PE file

Question

I am doing some bulk analytics on PE files, while parsing the import table of a PE file, I'm finding that many PE files import duplicate entries for a given DLL... why is this? what does this functionally provide?

For instance, a dump of example.exe import table shows:

Kernel32.dll User32.dll blah.dll Kernel32.dll Kernel32.dll User32.dll shell32.dll

Thanks in advance.

Answer 1

您观察到的正确且完全正常！看一下下图，它显示了Dependency Walker正在分析Process Explorer（静态）导入许多库的图像。迟早一个库会导入一个已经被其他库导入的库（例如，典型的例子是 USER32.DLL 或 NTDLL.DLL，它们几乎总是被多次导入）。

Answer 2

也许您正在分析的 PE 已被修补以导入其他功能，因为大多数二进制文件的导入地址表都非常紧凑，因此在现有模块中添加条目是相当不可能的。