Abstract: On the base of analyzing the import table of PE file,using the work principle of Windows loader and the uncertainty of PE file import table’s storage location,an algorithm based on the import table migration was proposed.Information is hidden in the original import table space of PE file.Theory analysis and experiment result show that the algorithm overcomes the disadvantages of previous hiding information schemes,such as hidden information convergence and destruction of import table,which improves hidden and anti-attack ability.

Key words: PE file,Information hiding,Import table,Import table migration