1

Im trying myself at writing a manual mapper, for injection of DLLs into other processes.

Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another process.

I have run into the problem, that my sample Hello world DLL relies on functions from the user32.dll, which means that i have to map that one too. The user32.dll relies in itself on other dll, which are among others imported via the API Set schema.

User32dll imports via api set schema

Take a note of the excact naming of the imported function, that I marked: "EventActivityIdControl"

As it turned out, the functions for this particular api are found in the advapi32.dll

If I look at that dll in CFF explorer, lo and behold there are the correct exports advapi32.dll exports the correct functions for the api

However, when I manually parse, the advapi32.dll and look at the exports, I get forwarded exports from ntdll.dll, with the prefix "Ewt", which messes up my string comparisons. Exports of advapi32.dll parsed by my code

This prefix seems to be omitted by CFF explorer and other similar software.

I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?

  • 1
    use vs dumpbin cff explorer migh tbe old I don't know C:\>dumpbin /exports c:\Windows\System32\advapi32.dll | grep -i acti 1288 11E EventActivityIdControl (forwarded to ntdll.EtwEventActivityIdControl) C:\> – blabb Apr 26 at 14:51
2

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.

In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screensot of my original question.

I was under the impression, that the name after the dot is also the name of the function as it is exported by the forwarding dll itself.

This is wrong. There is still a valid export name entry in the Export Names Table (EAT), that must be read to accomplish correct import to export name mapping.

I hope this explanation helps some other poor soul, that wastes hour on the same wrong assumption.

Here is a picture of the mapping from the forwarded function name to the name, that is used to export that forwarded function in the advapi32.dll

Forwarded function name to exported function name

As you can seen the export in the ntdll has the Etw prefix, that I was talking about and the named export in the advapi32 dll does not have this Prefix, which led me to my initial assumption, that CFF explorer was ommiting the prefix.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.