3

I am trying to get a DLL from an older version of Windows work on a newer version. I already patched the code to skip over the call to the missing import, but I now want to remove that ordinal import from the import table such that the DLL can be loaded.

Is there any easy way to skip over an import in the import table without having to shift all the subsequent imports back by one spot?

  • 3
    Assuming it's not the only import from that DLL, why not just set that entry to the same value as another one rather than deleting it? – Runemoro Mar 12 '18 at 3:48
2

Runemoro's answer from the comment seems like a very approachable one. You're going to need to update one (or two) RVAs in the FirstThunk (and/or OriginalFirstThunk) arrays referenced from the IMAGE_IMPORT_DESCRIPTOR for that DLL. Why not just patch that entry to contain some other innocuous RVA for another function imported from the same DLL?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.