I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".
First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to
dll is just extending
Export Directory and possibly changing some other fields. So, what you have to do is to:
dllin PE parser. It can be PE Explorer, CFF Explorer or in disassembler such as IDA (tick manual load, and then load all possible sections).
dll. Some changes may be done in above mentioned PE parsers, but not all.
1, since you are adding new function.
Export Address Table, which is located at
ExportDirectory.AddressOfFunctions. Just use hex editor to insert
4new NULL bytes - you will set their value when you insert your function's code.
ExportDirectory.AddressOfNameshas probably changed (by
4bytes). You have to adjust it as well.
ExportDirectory.AddressOfNames- insert another
4bytes using hex editor. Later on, you will change it to the name of your function.
2bytes using hex editor (highest ordinal
+ 1, write it in little endian).
ExportDirectory.Nameas well, to point to the
.textsection (if it is small enough, you won't have to resize it).
Export Directory Sizeto match your new size.
ExportDirectoryby number of bytes you have inserted using hex editor, or delete as this number of NULL bytes at the end of
As you see, it's a tedious process to do this manually and even if you find doing it too difficult, I hope that at least you see what has to be done "at low level" to add new export to a