I'm trying myself at writing a manual mapper, for injection of DLLs into other processes.
I've come to the point, where I've written a simple "Hello World"
.dll, that I'm trying to inject into another process.
I have run into the problem, that my sample Hello world DLL relies on functions from the
user32.dll, which means that I have to map that one too. The
user32.dll relies in itself on other
.dll, which are among others imported via the API Set schema.
Take a note of the exact naming of the imported function, that I marked:
As it turned out, the functions for this particular API are found in the
If I look at that DLL in CFF explorer, lo and behold there are the correct exports:
This prefix seems to be omitted by CFF explorer and other similar software.
I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?