I was manually adding a dll to a program's import table. Took me awhile, but I finally got it to work. I had trouble figuring out where to place the IMAGE_IMPORT_DESCRIPTOR.FirstThunk because of memory access violations.

This is what I did, the problem that arose, and how I fixed it. I am hoping someone here can explain why this occurred.

I copied the IMAGE_IMPORT_DESCRIPTOR array into the unused space at the end of the same section they were in.
I added my IMAGE_IMPORT_DESCRIPTOR to the front of the list.
I changed the IMAGE_DATA_DIRECTORY for the import section to point to my new set, and updated the size.
After the blank IMAGE_IMPORT_DESCRIPTOR at the end of the array, i put the dll name, then the IMAGE_IMPORT_BY_NAME with the hint and the function I wanted to use.
I placed the IMAGE_THUNK_DATA32 dwords for my OriginalFirstThunk and FirstThunk at the end.
I set everything in my IMPORT_IMAGE_DESCRIPTOR and my thunks correctly, then verified my work with Dependency Walker and LordPE.
When executed, the program crashed. Under a debugger I found out that a memory access violation was occurring when Windows was setting the actual address for my imported function.
I then changed the section header VirtualSize to include all the stuff I had added, but still got the memory access error.
I ended up having to point my FirstThunk to some space that I found at the beginning of the section, amongst the FirstThunks for the imports the program originally had.

What I don't understand is why, if all my modifications are in the same section, would having my FirstThunk at the beginning of the section work fine, but fail if it is at the end? When I looked at the program's address space (after it was running successfully) the whole section was mapped Execute/Read but had been allocated as WriteCopy. Does Windows insist that the IAT be at the start of a section? Does it have to fit in a certain size? Does the loader map the first part of a section differently than the rest?

Interesting... could you attach the not working rebuilt?

This version doesn't load, but is not exactly as I described above. In this version, I put my added import at the end of the list and pointed my FirstThunk to overwrite the FirstThunk of the API I wanted to replace.

If you change offset 0x12244 from "84 22 01" to "98 F0 00", it should execute properly. The first time I got it to work, I set it to "38 F7 00", but I had to patch the call as well as change offset 0xF738 from "00 00 00" to "68 22 01" to point to my dll's exported function name.

Stuff I changed:
0x12180 - My import table
0x1225C - My imported dll name
0x12268 - My IMAGE_IMPORT_BY_NAME
0x1227C - My OriginalFirstThunk
0x12284 - My FirstThunk that causes the error
(those were all 00's)
0x0168 - Old Import DATA_DIRECTORY was "D0 12 01 00 C8"
0x0210 - Old SECTION_HEADER[1].VirtualSize was "34 31"
0x???? - Somewhere in the program a JE xxx is changed to JMP xxx

OK, the reason of the error is the following.

Go to data directory of PE header, and check the values:
Import Address Table Directory RVA
Import Address Table Directory Size

There you have got defined the size of the block where the pointers to names of function will be replaced by the handles of those functions, by the windows loader. As your new pointer is out of that block, it won't be able of load. If you want this executable to be ready to run, just set both values to zero...

Btw, good work!

Best regards

Nacho_dj

Thanks alot. I guess I should read to the end of the page...and pay more attention, too, lol.