advapi32.dll changes name of function during forwarding of exports

Question

Im trying myself at writing a manual mapper, for injection of DLLs into other processes.

Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another process.

I have run into the problem, that my sample Hello world DLL relies on functions from the user32.dll, which means that i have to map that one too. The user32.dll relies in itself on other dll, which are among others imported via the API Set schema.

Take a note of the excact naming of the imported function, that I marked: "EventActivityIdControl"

As it turned out, the functions for this particular api are found in the advapi32.dll

If I look at that dll in CFF explorer, lo and behold there are the correct exports

However, when I manually parse, the advapi32.dll and look at the exports, I get forwarded exports from ntdll.dll, with the prefix "Ewt", which messes up my string comparisons.

This prefix seems to be omitted by CFF explorer and other similar software.

I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?

Answer 1

Shortly after posting the question I took a closer look at my code for parsing the exports and came to the realization, that I made an incorrect assumption.

In the export directory entries, if a function entry point to the export section, you can find a string there, which depicts the forwarder export name. An example of that is visible in the last screensot of my original question.

I was under the impression, that the name after the dot is also the name of the function as it is exported by the forwarding dll itself.

This is wrong. There is still a valid export name entry in the Export Names Table (EAT), that must be read to accomplish correct import to export name mapping.

I hope this explanation helps some other poor soul, that wastes hour on the same wrong assumption.

Here is a picture of the mapping from the forwarded function name to the name, that is used to export that forwarded function in the advapi32.dll

As you can seen the export in the ntdll has the Etw prefix, that I was talking about and the named export in the advapi32 dll does not have this Prefix, which led me to my initial assumption, that CFF explorer was ommiting the prefix.