advapi32.dll changes name of function during forwarding of exports

Question

I'm trying myself at writing a manual mapper, for injection of DLLs into other processes.

I've come to the point, where I've written a simple "Hello World" .dll, that I'm trying to inject into another process.

I have run into the problem, that my sample Hello world DLL relies on functions from the user32.dll, which means that I have to map that one too. The user32.dll relies in itself on other .dll, which are among others imported via the API Set schema.

Take a note of the exact naming of the imported function, that I marked: EventActivityIdControl

As it turned out, the functions for this particular API are found in the advapi32.dll.

If I look at that DLL in CFF explorer, lo and behold there are the correct exports:

However, when I manually parse, the advapi32.dll and look at the exports, I get forwarded exports from ntdll.dll, with the prefix Etw, which messes up my string comparisons.

This prefix seems to be omitted by CFF explorer and other similar software.

I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?

Answer 1

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.

In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screenshot of my original question.

I was under the impression, that the name after the dot is also the name of the function as it is exported by the forwarding DLL itself.

This is wrong. There is still a valid export name entry in the Export Names Table (EAT), that must be read to accomplish correct import to export name mapping.

I hope this explanation helps some other poor soul, that wastes hour on the same wrong assumption.

Here is a picture of the mapping from the forwarded function name to the name, that is used to export that forwarded function in the advapi32.dll.

As you can seen the export in the ntdll.dll has the Etw prefix, that I was talking about and the named export in the advapi32 dll does not have this Prefix, which led me to my initial assumption, that CFF explorer was omitting the prefix.

Answer 2

Who said the name when attaching .DEF file must be same? For example:

LIBRARY "A.DLL"

EXPORTS
    AABBCC = ANOTHER.ABCABC

In the advapi32.dll, it might be this (for example, only EqualSID and EventActivityIdControl is included):

LIBRARY "ADVAPI32.DLL"

EXPORTS
    EqualSID
    EventActivityIdControl = ntdll.EtwEventActivityIdControl