Skip to main content
Bounty Ended with 150 reputation awarded by alexanderh
added 140 characters in body
Source Link
blabb
  • 16.7k
  • 1
  • 15
  • 30

edit
windows -> reset desktop works the same ways as closing and opening the database so that eleiminates closing and opening of database

edit
windows -> reset desktop works the same ways as closing and opening the database so that eleiminates closing and opening of database

added 720 characters in body
Source Link
blabb
  • 16.7k
  • 1
  • 15
  • 30

compiling these three lines into a plugin will add the Desired import into the first module's import

void idaapi run(int) {
nodeidx_t index = import_node.alt1st();
unsigned long value = import_node.altval(index);
netnode(value).supset(0x410004,"GetShortPathNameA\0");
}

the idc file to create Segment

#include <idc.idc>
static main()
{
auto addr;
addr = 0x410000;
SegCreate(addr,addr+0x200,0,1,3,2);
SetSegmentType(addr,SEG_XTRN);
MakeDword(addr+4);
MakeName(addr+4,"GetShortPathNameA");
}

open an exe / run idc / plugin / close and save database / reopen database to see the added imports in imports tab of first module

compiling these three lines into a plugin will add the Desired import into the first module's import

void idaapi run(int) {
nodeidx_t index = import_node.alt1st();
unsigned long value = import_node.altval(index);
netnode(value).supset(0x410004,"GetShortPathNameA\0");
}

the idc file to create Segment

#include <idc.idc>
static main()
{
auto addr;
addr = 0x410000;
SegCreate(addr,addr+0x200,0,1,3,2);
SetSegmentType(addr,SEG_XTRN);
MakeDword(addr+4);
MakeName(addr+4,"GetShortPathNameA");
}

open an exe / run idc / plugin / close and save database / reopen database to see the added imports in imports tab of first module

Source Link
blabb
  • 16.7k
  • 1
  • 15
  • 30

if adding an extra import section to the PE file is an acceptable option

use tools like iidking and add an import section with all the imports that are resolved dynamically

use add cross referances dialog or idc add_dref() to add cross references to them

code for demo

#include <stdio.h>
#include <windows.h>
#pragma comment(lib , "user32.lib")
DWORD (WINAPI * MyGetShortPathName)(LPCTSTR,LPTSTR,DWORD);
int main (void) {
    MessageBox(NULL,"testing add import" , "Test", MB_OK);
    char modname[MAX_PATH] = {0};
    GetModuleFileName(NULL,modname,MAX_PATH);
    printf("%s\n",modname);
    HMODULE hMod = LoadLibrary("kernel32.dll");
    if(hMod) {
        *(FARPROC *)&MyGetShortPathName = GetProcAddress(hMod,"GetShortPathNameA");
        if(MyGetShortPathName) {
            MyGetShortPathName(modname,modname,MAX_PATH);
            printf("%s\n",modname);
        }
    }
    return 0;
}

compiled and executed

C:\codesnips\addimp\addimp.exe
C:\CODESN~1\addimp\addimp.exe

unmodified imports

00412000  GetCurrentThread                      KERNEL32 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
00412130  MessageBoxA                           USER32   

exe modified with iidking and an import GetShortPathNameA added in the extra import section

C:\codesnips\addimp>fc /b addimp.exe modaddimp.exe
Comparing files addimp.exe and MODADDIMP.EXE
000000E6: 04 05  no of section 
00000131: 90 A0  
00000160: F4 00
00000161: 47 90
00000164: 3C 50
00000278: 00 2E .
00000279: 00 49 I
0000027A: 00 49 I
0000027B: 00 44 D
0000027C: 00 4B K
0000027D: 00 69 I
0000027E: 00 6E N
0000027F: 00 67 G
00000281: 00 02 vsize
00000285: 00 90 
00000286: 00 01
00000289: 00 02
0000028D: 00 5E
0000028E: 00 01
0000029C: 00 20
0000029F: 00 E0

ida imports window copy paste of modified exe

00412000  GetCurrentThread                      KERNEL32 
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
00412130  MessageBoxA                           USER32   
00419058  GetShortPathNameA                     kernel32 

double clicked 419058 -> open view -> open subviews -> crooss referances-> add cross refernces

Up P sub_401000+89 call    ds:GetProcAddress  (data xref)

or idc command

add_dref(0x401089,0x419058,53);
AddCodeXref(0x419058,0x401089,53);

AddImports