Questions tagged [iat]
Import Address Table are used as a lookup table when the application is calling a function in a different module in Microsoft Windows operating systems.
25
questions
2
votes
0
answers
89
views
statically placing hooks on PE file's IAT
recently I started writing my own PE library for C++, and wanted to implement static IAT/EAT hooking, (basically hooking by patching the file instead of hooking at runtime), I managed to successfully ...
- 21
1
vote
0
answers
101
views
Patching out relative calls to DLL functions
I have googled, watched several videos, read the PE spec, and even read some blogs. I am at a loss on how to patch out a message box. I am working through a CTF whose first task is to disable a nag ...
- 23
3
votes
3
answers
772
views
IAT Hook via Kernel Driver
I've wrote a kernel driver recently and it does multiple things, but I wanted to add a IAT hook for a certain driver.
I want to hook the IAT of another driver from my driver if that makes sense.
So I ...
- 49
2
votes
1
answer
410
views
Hooking IAT in remote process with Python?
I'm trying to hook a win32 function call (CreateFileW) inside of a notepad process to have the function do additional actions before returning what it should do. Ultimately, this will assist me in ...
- 51
3
votes
2
answers
684
views
Find the entry point in Interrupt Vector Table ARM9
I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings.
I've disassembled the firmware using ida pro, but I couldn't find the entry ...
- 31
1
vote
2
answers
233
views
Using IAT Hooking to hook end of function
Is it possible? Maybe you can explain it with a simple example if that's possible?
- 11
2
votes
1
answer
340
views
Import Address Table in Process Hollowing
I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT?
We just copy ...
- 21
4
votes
1
answer
224
views
Statically recovering thunks in Windows x86_64 DLL
I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
- 143
2
votes
1
answer
154
views
PE - IAT resolve mechanism
I'm trying to understand how Windows is resolving functions with the IAT.
I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
- 709
1
vote
1
answer
179
views
Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?
I want to implement a full blown import reconstructor into my app without any external dll's or Shell Executes to EXEs. I want to just have the ability to get IAT Import addresses to certain imported ...
- 759
1
vote
3
answers
2k
views
FThunks when trying to get IAT
Pretty new to RE so sorry if this is a dumb question.
I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
0
votes
1
answer
448
views
Getting Xrefs to Windows Library Functions in IDA Pro
Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
- 395
3
votes
1
answer
994
views
How do I call a statically imported function from a Dll? call dword ptr ds <> not working
Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call.
Now I actually want to do things with a ...
- 53
2
votes
2
answers
3k
views
Statically detect destroyed Import Segment (IAT)
I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
- 426
1
vote
1
answer
651
views
ImpRec invalid NtdllDefWindowProc_A seem valid
I have a problem that NtdllDefWindowProc_A function from ntdll is
inside user32 thunk.
Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
- 115
0
votes
1
answer
4k
views
what is IAT? and how to find the end of the IAT in packed exe?
I recently started to study RE in my free time. I started to look at lena151
free tutorials and now I'm on packers/protectors.
Now i reached to the part that he show how to manually find the end of ...
- 115
0
votes
1
answer
490
views
Why is IAT filled with static addresses instead of function names?
When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
- 57
1
vote
2
answers
589
views
Why isn't the import table ready at OEP?
When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
- 57
2
votes
3
answers
2k
views
iat errors in rebuilt executable
I have rebuilt the iat table of a UPX packed to the point where there are no invalid thunks (All "Yes"), I then fix the dump though when I open the final fixed executable in impRec I get invalid ...
- 31
1
vote
1
answer
116
views
List late binding functions
I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
- 113
1
vote
1
answer
1k
views
ImpRec invalid thunks seem valid
I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
- 31
5
votes
3
answers
3k
views
IDA Pro Renaming Imports
This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here:
Any straight forward way to rename these functions?
- 81
2
votes
1
answer
2k
views
kernel32.BaseThreadInitThunk without IAT
On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk.
notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk.
I cannot find that ...
- 67
3
votes
1
answer
193
views
Application crashes after IAT address change
I have an old piece of software (for cutting and plotting vectors onto physical media) (released about 2000-2001) which I use to this day. The software employs a HASP HL with a parallel port hardware ...
- 131
4
votes
2
answers
1k
views
Using Python CTypes to get to the IAT
I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/...
- 211