Kayaker
June 20th, 2001, 23:36
'Lo All,
How about a little challenge this time to manually rebuild an Import table? There's an interesting reversing task as well once the first step is done.
Again I offer up a unique reversing tool as a target, called KeyCode, which is "An auxiliary utility for developers. It gets information generated by Windows under pressed/depressed keys. Such information may be messages sent by Windows, virtual key code, OEM scan code, etc. The utility hides its own window after switching on another application, besides the program activation may be carried out by pressing the hotkey (Ctrl-F12) from any application. The program is freeware and freely distributable". (7K attached file)
PART 1:
What I did was first to dump the program from memory so the Virtual and Raw Offsets would be equal. This makes rebuilding so much easier while working in a hex editor, which is where you're going to be spending most of your time btw, heheh. There and in PEditor.
This was the end of me being Mr. Nice Guy though. I then made 3 distinct types of changes to the Import table. Your job is obvious. The problems aren't extremely difficult, but I think that by the end of it anyone unfamiliar with exactly how the Import section is constructed will have a much better handle on it. I tried to leave enough clues as to the structure of the section that even if you're confused by the documentation, it can still be figured out strictly as a logic exercise. (sort of like a Myst puzzle
A few recommended refs:
Iczelion's PE Format Tutorials (Tutorial 6: Import Table)
http://win32asm.cjb.net/
[yAtEs] Understanding Import Tables
http://www.woodmann.com/yates/Import_tables.txt
TiTi - PE Files Import Table Rebuilding
http://www.woodmann.com/yates/rebuild.txt
PART 2:
The app has the annoying habit of hiding itself as soon as it loses mouse focus. You call it up again with Ctrl-F12. This is by design, so be careful when you're testing during the 1st part, you may have been successful but miss seeing the small window.
The second challenge is to stop the window from hiding itself. Quite do-able in several ways.
Lemme know if there's any questions.
Cheers and Good Luck,
Kayaker
EDIT: Project file reuploaded, this time along with the original KeyInfo program files, Links updated. Dec '03
How about a little challenge this time to manually rebuild an Import table? There's an interesting reversing task as well once the first step is done.
Again I offer up a unique reversing tool as a target, called KeyCode, which is "An auxiliary utility for developers. It gets information generated by Windows under pressed/depressed keys. Such information may be messages sent by Windows, virtual key code, OEM scan code, etc. The utility hides its own window after switching on another application, besides the program activation may be carried out by pressing the hotkey (Ctrl-F12) from any application. The program is freeware and freely distributable". (7K attached file)
PART 1:
What I did was first to dump the program from memory so the Virtual and Raw Offsets would be equal. This makes rebuilding so much easier while working in a hex editor, which is where you're going to be spending most of your time btw, heheh. There and in PEditor.
This was the end of me being Mr. Nice Guy though. I then made 3 distinct types of changes to the Import table. Your job is obvious. The problems aren't extremely difficult, but I think that by the end of it anyone unfamiliar with exactly how the Import section is constructed will have a much better handle on it. I tried to leave enough clues as to the structure of the section that even if you're confused by the documentation, it can still be figured out strictly as a logic exercise. (sort of like a Myst puzzle

A few recommended refs:
Iczelion's PE Format Tutorials (Tutorial 6: Import Table)
http://win32asm.cjb.net/
[yAtEs] Understanding Import Tables
http://www.woodmann.com/yates/Import_tables.txt
TiTi - PE Files Import Table Rebuilding
http://www.woodmann.com/yates/rebuild.txt
PART 2:
The app has the annoying habit of hiding itself as soon as it loses mouse focus. You call it up again with Ctrl-F12. This is by design, so be careful when you're testing during the 1st part, you may have been successful but miss seeing the small window.
The second challenge is to stop the window from hiding itself. Quite do-able in several ways.
Lemme know if there's any questions.
Cheers and Good Luck,
Kayaker
EDIT: Project file reuploaded, this time along with the original KeyInfo program files, Links updated. Dec '03