View Full Version : Adding API To IAT
durexlw
February 1st, 2008, 08:50
I am wondering if it's possible to add an API call to the IAT
In my case, I'd like to add User32.SendDlgItemMessage to an application, so I can use it to patch the application.
If you can point me in the right direction, i'd be happy to hear from you.
Cheers,
Durex
evlncrn8
February 1st, 2008, 10:14
just edit the import table, hardly rocket science... if theres no space, make a new iat, and append the api's you need into it...
deroko
February 1st, 2008, 10:34
1. create new section or expand last section
2. copy IMAGE_IMPORT_DESCRIPTORs there
3. add your IMAGE_IMPORT_DESCRIPTOR and update it to point to dll name and api_name + address where you want it stored
4. update PE.OptionalHeader.DataDirectories[IMPORT] with RVA of place where you moved old ones
5. done
or
use IIDKing to do this
OHPen
February 1st, 2008, 10:38
LOL: deroko and i nearly posted at the same time. so forget my post
lo,
i agree with evlncrn8, should be no problem to append a new section for example and, create a new iat from the scratch, relying on the old iat + adding needed api functions. afterwards you just have to link the iat pointer just to point to new section.
if i remember correctly there was a well known tool which do exactly like that, but i forgot, sorry.
regards,
papi
Admiral
February 1st, 2008, 10:38
There are a few tools out there that can automate this process. I can't personally vouch for any but IIDKing looks like the most suitable in the CRECTL:
http://www.woodmann.com/collaborative/tools/Category:Import_Editors
Admiral
deroko
February 1st, 2008, 11:02
Quote:
[Originally Posted by OHPen;72409]LOL: deroko and i nearly posted at the same time. so forget my post  |

I was faster

OHPen
February 1st, 2008, 11:55
@deroko: yeah, damn'it

disavowed
February 2nd, 2008, 20:17
LordPE can do that too. i'll add it to the CRCETL page (it's not on there at the moment).
Admiral
February 2nd, 2008, 20:39
Quote:
[Originally Posted by disavowed;72425]LordPE can do that too. i'll add it to the CRCETL page (it's not on there at the moment). |
Huh. I've been using LordPE for as long as I've been on solids and not once did I discover this feature. That would have saved me some grief on a few occasions

.
Still learning then

Nacho_dj
February 3rd, 2008, 05:28
If you don't want to increase the size in your executable, you could add your API using some of those tools in the same place where I.T. is now, building IAT by ordinals, because it won't use Names of Functions. But it is not a good idea if you are carrying your executable to another machine, since ordinals are strongly system version dependent.
Cheers
Nacho_dj
disavowed
February 3rd, 2008, 12:39
Quote:
[Originally Posted by Admiral;72426]Huh. I've been using LordPE for as long as I've been on solids and not once did I discover this feature. That would have saved me some grief on a few occasions .
Still learning then  |
yeah, just right-click on an imported dll in the import-table viewer and click "add import..."
Powered by vBulletin® Version 4.2.2 Copyright © 2019 vBulletin Solutions, Inc. All rights reserved.