Log in

View Full Version : Problem resolving KERNEL32 imports

ancev
December 12th, 2005, 23:04
hi guys,

i am resolving imports from kernel32, using my own routine (that scan dll export table, in the classical and tested way), but i am getting weird results with some APIs...

for example, when trying to get the address of HeapAlloc, i get a address... but in this address, isnt function code, but a string: NTDLL.HeapAllocate

the same happen with others APIs, like RtlUnwind

anybody know whats happening? i am using xp sp2, and i already coded that dll export scan routine 100 times, and it always worked

thanks in advance,
ancev
Opcode
December 12th, 2005, 23:11
Hi...

This feature is called "Export Forwarding"

Quote from http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx


Quote:
"Export Forwarding
A particularly slick feature of exports is the ability to "forward" an export to another DLL. For example, in Windows NT®, Windows® 2000, and Windows XP, the KERNEL32 HeapAlloc function is forwarded to the RtlAllocHeap function exported by NTDLL. Forwarding is performed at link time by a special syntax in the EXPORTS section of the .DEF file. Using HeapAlloc as an example, KERNEL32's DEF file would contain:

EXPORTS
•••
HeapAlloc = NTDLL.RtlAllocHeap

How can you tell if a function is forwarded rather than exported normally? It's somewhat tricky. Normally, the EAT contains the RVA of the exported symbol. However, if the function's RVA is inside the exports section (as given by the VirtualAddress and Size fields in the DataDirectory), the symbol is forwarded.
When a symbol is forwarded, its RVA obviously can't be a code or data address in the current module. Instead, the RVA points to an ASCII string of the DLL and symbol name to which it is forwarded. In the prior example, it would be NTDLL.RtlAllocHeap."


Regards,
Opcode
ancev
December 13th, 2005, 08:00
opcode,

thanks! i always thought that export forwarding has to do with ForwarderChain field in import entry

but now i know how resolve it

thanks again,
ancev