I am writing a program where I map an .exe
PE file in memory and I "dissect" it.
I am disassembling the .text
section of the target executable, using the distorm disassembler.
CALL
instructions in the disassembly have an offset relative to the RIP
register, e.g.: CALL QWORD [RIP+0xf8e]
.
I am also reading the Import Descriptor Table
and I can see all the function calls from various .dlls there.
When using dumpbin.exe with /section:.text /disasm
to disassemble the same target .exe
, although it shows the same opcodes ff 15 8e 0f 00 00
, it somehow translates this RIP offset to the proper (and correct) Win32 function being called (in my program GetCurrentProcessId()
), call qword ptr [__imp_GetCurrentProcessId]
.
My question is how to "map"/resolve each CALL
instruction that I see in my disassembly to a specific Win32 API call, like dumpbin does, since I don't run this program inside the debugger and therefore the IAT is not overwritten by the Windows loader to show the proper jmp
instruction calling the Windows API. Is it a disassembler issue? Can I deduct this somehow using the various PE structures?
0xf8e
in my case.