Log in

View Full Version : Function as References


Bengaly
August 24th, 2003, 08:22
here is a small text i wrote in order to get a function as a reference to CALL XXXXXXXX or JMP DWORD PTR [XXXXXXXX] in a disassembler engine.
if anyone seen some missing information / or some wrong informative text please fix & reUpload (if u want ofcourse)
have fun.

squidge
August 24th, 2003, 10:38
Not bad

However, the two bytes before the API function name is the hint, and not the Ordinal -

Offset
Size
Field
Description

0
2
Hint
Index into the Export Name Pointer Table. A match is attempted first with this value. If it fails, a binary search is performed on the DLL's Export Name Pointer Table.

2
variable
Name
ASCII string containing name to import. This is the string that must be matched to the public name in the DLL. This string is case sensitive and terminated by a null byte.

*
0 or 1
Pad
A trailing zero pad byte appears after the trailing null byte, if necessary, to align the next entry on an even boundary.

Other than that, it seems ok. I've only had a quick glance at it tho'

In RTA, I load the IAT into memory and go through each DLL, making a note of all the addresses of functions in a mapped array, so that if I see a direct (or in-direct jump), I can immediately display the api name and function name without doing a lot of searching.

Bengaly
August 24th, 2003, 18:15
thnx, i wrote that text at 5 am ...
i know there are some need of midifications .