2

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll

What can u suggest to solve this ?

  • what is your final goal with this? – Igor Skochinsky Jun 14 at 9:34
  • @IgorSkochinsky i want to handle function that is being called from .exe and process it's object data. I did some workaround renaming function that is missing in .dll to existing but not used function is same .dll , and hooking it via trampoline . But i'm worried it might create some issues. – LighFusion Jun 14 at 20:04
2

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".

First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, what you have to do is to:

  1. Open your dll in PE parser. It can be PE Explorer, CFF Explorer or in disassembler such as IDA (tick manual load, and then load all possible sections).
  2. Open your favourite hex editor in order to patch dll. Some changes may be done in above mentioned PE parsers, but not all.
  3. Increase ExportDirectory.NumberOfFunctions by 1, since you are adding new function.
  4. Do the same thing with ExportDirectory.NumberOfNames.
  5. Now, you have to add new entry to Export Address Table, which is located at ExportDirectory.AddressOfFunctions. Just use hex editor to insert 4 new NULL bytes - you will set their value when you insert your function's code.
  6. After previous step, ExportDirectory.AddressOfNames has probably changed (by 4 bytes). You have to adjust it as well.
  7. Now, insert new entry to ExportDirectory.AddressOfNames - insert another 4 bytes using hex editor. Later on, you will change it to the name of your function.
  8. As in step 6. and 7., adjust ExportDirectory.AddressOfNameOrdinals and add 2 bytes using hex editor (highest ordinal + 1, write it in little endian).
  9. Since you have inserted several new bytes, you have to change ExportDirectory.Name as well, to point to the dll name.
  10. Now, insert your function's name at the end of the table of function names (last entry in ExportDirectory.AddressOfNames).
  11. Set the entry you have created in 7. so it points to your function name.
  12. Insert your function's code at the end of .text section (if it is small enough, you won't have to resize it).
  13. Set the entry you have created in 5.
  14. Change Export Directory Size to match your new size.
  15. Use the same value for changing SectionHeader.VirtualSize for .edata section.
  16. Increase FileHeader.NumberOfSymbols by 1.
  17. Either increase SectionTable.SizeOfRawData for ExportDirectory by number of bytes you have inserted using hex editor, or delete as this number of NULL bytes at the end of ExportDirectory (if present).
  18. Zero out or compute new OptionalHeader.CheckSum.

As you see, it's a tedious process to do this manually and even if you find doing it too difficult, I hope that at least you see what has to be done "at low level" to add new export to a dll.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.