Timeline for In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 31, 2015 at 15:58 | history | bounty ended | alexanderh | ||
| Mar 31, 2015 at 15:58 | comment | added | alexanderh | I cant verify the code right now but since the bounty is about to expire I'll award it to you. Thanks for the update. | |
| Mar 31, 2015 at 5:31 | history | edited | blabb | CC BY-SA 3.0 |
added 140 characters in body
|
| Mar 30, 2015 at 23:21 | comment | added | blabb | updated the answer with a workaround for idb files | |
| Mar 30, 2015 at 23:18 | history | edited | blabb | CC BY-SA 3.0 |
added 720 characters in body
|
| Mar 26, 2015 at 15:45 | comment | added | alexanderh | I understand your thought process but it still doesn't answer how to add the imports to the import tab via IDC or Python in IDA. Which is the original request. Check out NirIzr answer it is the closest. | |
| Mar 26, 2015 at 5:34 | comment | added | blabb | if you are convinced about the reasoning i am fine with that but my thought process is like this if ida has enough information to retirieve and create the original imports then it should be capable of finding this too. the original query seemed to imply that the pe is available and didn't say anything about non availabilty of the original pe so i posted this approach with a caveat if modifying the exe is acceptable if your new requiremnts are about mucking with an idb standlaone then i dont have any idea | |
| Mar 25, 2015 at 20:41 | comment | added | alexanderh | I might be mistaken but your example would not work on samples that are missing the portable executable header. Examples of these would be shellcode, injected DLLs that zero out the header, or position independent code ( no header and resolves symbols address by traversing PEB for kernel32.dll). Sure, a PE header could be added but this isn't always a feasible approach because it relies on having and modifying the binary. | |
| Mar 25, 2015 at 18:54 | comment | added | blabb | can you elaborate or post / point to a sample where this doesn't seem to work ? | |
| Mar 25, 2015 at 14:19 | comment | added | alexanderh | Thanks for the answer! Unfortunately this won't work for some unpacked executables or when dealing with position independent code. | |
| Mar 24, 2015 at 23:28 | history | answered | blabb | CC BY-SA 3.0 |