I'm trying myself at writing a manual mapper, for injection of DLLs into other processes.

I've come to the point, where I've written a simple "Hello World" .dll, that I'm trying to inject into another process.

I have run into the problem, that my sample Hello world DLL relies on functions from the user32.dll, which means that I have to map that one too. The user32.dll relies in itself on other .dll, which are among others imported via the API Set schema.

User32dll imports via api set schema

Take a note of the exact naming of the imported function, that I marked: EventActivityIdControl

As it turned out, the functions for this particular API are found in the advapi32.dll.

If I look at that DLL in CFF explorer, lo and behold there are the correct exports:

advapi32.dll exports the correct functions for the api

However, when I manually parse, the advapi32.dll and look at the exports, I get forwarded exports from ntdll.dll, with the prefix Etw, which messes up my string comparisons. Exports of advapi32.dll parsed by my code

This prefix seems to be omitted by CFF explorer and other similar software.

I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?

  • 1
    use vs dumpbin cff explorer migh tbe old I don't know C:\>dumpbin /exports c:\Windows\System32\advapi32.dll | grep -i acti 1288 11E EventActivityIdControl (forwarded to ntdll.EtwEventActivityIdControl) C:\>
    – blabb
    Apr 26, 2020 at 14:51

2 Answers 2


Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.

In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screenshot of my original question.

I was under the impression, that the name after the dot is also the name of the function as it is exported by the forwarding DLL itself.

This is wrong. There is still a valid export name entry in the Export Names Table (EAT), that must be read to accomplish correct import to export name mapping.

I hope this explanation helps some other poor soul, that wastes hour on the same wrong assumption.

Here is a picture of the mapping from the forwarded function name to the name, that is used to export that forwarded function in the advapi32.dll.

Forwarded function name to exported function name

As you can seen the export in the ntdll.dll has the Etw prefix, that I was talking about and the named export in the advapi32 dll does not have this Prefix, which led me to my initial assumption, that CFF explorer was omitting the prefix.


Who said the name when attaching .DEF file must be same? For example:



In the advapi32.dll, it might be this (for example, only EqualSID and EventActivityIdControl is included):


    EventActivityIdControl = ntdll.EtwEventActivityIdControl

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.