0

I've been noticing this for a while. Functions like IsDebuggerPresent and GetModuleHandle are always present in a binary's import directory structure. I assume is the Window's dynamic linker, but where do I find information about it? Below is a screenshot of the "default" functions I'm talking about which are always imported.

enter image description here

Improve this question
4
  • 1
    in what binary? did you inspect all the countless billions of files out there? What else is common among all binaries you've checked?
    – Igor Skochinsky ♦
    Commented Sep 24, 2021 at 17:19
  • 1
    The 'standard' imports will vary based on the compiler you use. That said, these are often used by the compiler to perform various things such as handling exceptions (SetUnhandledExceptionFilter, ..) and so on. To see what each function does, you can just go to msdn or any documentation site. If you are looking for a one-page-guide as to why all these functions are imported, you will probably need to look at some sort of pdf/article about how a compiler works internally.
    – Niraeth
    Commented Sep 25, 2021 at 11:40
  • Thanks for the pointers. I will look into the Windows compiler, tho I'm afraid there won't be many resources out there
    – unc4nny
    Commented Sep 25, 2021 at 17:45
  • 1
    @unc4nny what "Windows compiler"? Several compilers exist for Windows, including Visual C++ from Microsoft, Clang, Intel's compiler and GCC. The compiler runtime and the C runtime are the most likely "culprits" regarding those imports, but you don't give enough details as Igor already tried to point out. Your main() function in a C or C++ is rarely ever identical to the entry point of the binary file. And the part that runs before (and "around") the main() function (aka the runtime) is what influences stuff that seems to be always there.
    – 0xC0000022L ♦
    Commented Sep 25, 2021 at 22:08

2 Answers 2

Reset to default
4

At a guess (since you don't provide much detail), the binaries you're looking at were compiled using a recent version of Microsoft Visual C++. The listed APIs are used by its CRT (C runtime) library in functions referenced by the startup or essential runtime code which is linked into every executable by default. You can find (most of) the CRT sources installed with Visual Studio and check yourself how these APIs are used. For example, IsDebuggerPresent is used by the __raise_securityfailure function which is called when the security cookie check fails (and in some other cases).

Since there are other compilers besides Visual C++ as well as its older versions, there are definitely binaries out there which do not import all or even any of these APIs. In fact, you can make a program which does not link to kernel32 at all (for example, by using only native APIs from ntdll.dll or by loading the DLL dynamically shellcode style).

Improve this answer
1
  • Thank you! Sorry for not providing much detail, I wasn't exactly sure how to phrase the question. But you provided me all the answers that I needed. Cheers
    – unc4nny
    Commented Sep 25, 2021 at 21:52
-1

IsDebuggerPresent is use to determine if the program is being debugged while GetModuleHandle is use to retrieve the handle on a specific module (Imagebase address) that exist in the current process context. These APIs can be not exist both in any program and does not have any relation with the windows dynamic linker.

There are other programs that don't have imported libraries and will resolved dynamically without the use of those APIs.

Improve this answer
1
  • 1
    I'm already acquainted with their behaviour. I was just wondering why they are present in the import table even tho I'm not using them in my code.
    – unc4nny
    Commented Sep 25, 2021 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.