Skip to main content
3 votes
Accepted

Hooking IAT in remote process with Python?

I cross-posted this to another community that I'm a part of and ended up getting my answer (I should have done this sooner..): It was likely that my code was getting garbage collected, hence the lock ...
tunemein's user avatar
3 votes

Find the entry point in Interrupt Vector Table ARM9

For the ARM946E-S Technical Reference Manual, the exception vectors (including the reset vector) should be located at either 0x00000000 or 0xFFFF0000 in memory, depending on whether the Alternate ...
Brendan Dolan-Gavitt's user avatar
2 votes
Accepted

Statically recovering thunks in Windows x86_64 DLL

PART 1 The PE import thunks do not work the same way as ELF PLT. There is no dynamic resolver invoked on the first call but all import pointers are resolved at the process startup ahead of time (...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

PE - IAT resolve mechanism

The direct call can be generated by the compiler when it knows that the function comes from a DLL at compile time, or whole program optimization is used. If the target function is not marked as ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

IAT Hook via Kernel Driver

The problem seems to be in the source address calculation: &ImportDescriptor.Name + (uintptr_t)ModuleBase This adds the address of a local variable (which is on the stack) to the image base, so ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

It appears you've already guessed what the actual issue is - your call instruction is using direct addressing and not relative addressing. This means that when a DLL changes it's location between ...
NirIzr's user avatar
  • 11.8k
2 votes

Find the entry point in Interrupt Vector Table ARM9

The first bytes are the exception vectors: CODE:00000000 LDR PC, =0x1000005C CODE:00000004 ; --------------------------------------------------------------------------- ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote
Accepted

IAT Hook via Kernel Driver

So, it turns out that if you're testing an IAT hook on a driver, the driver must be compiled in the release mode rather than in the debug one. If the driver is compiled in the debug mode, the RVA for ...
Ballers's user avatar
  • 49
1 vote

IAT Hook via Kernel Driver

This is unfortunately not going to be an answer, because you don't give enough information. If I end up writing an answer, it will be a different one. So long I'll make this non-answer a community ...
1 vote

Using IAT Hooking to hook end of function

Hooking would be the same in both cases: Whether you wanted to manipulate a function's parameters, and then provide them to the original function. In that case the order goes: Execute your hook code....
Abdullah Mohamed's user avatar
1 vote

Using IAT Hooking to hook end of function

The IAT entries point to the function's entry point, so you can try the following: Save the current IAT entry value into a variable (e.g. old_func). Patch the IAT entry with the address of your hook ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote

Import Address Table in Process Hollowing

Obviously you should resolve the address in IAT. This is a manually mapped dll code, you can take a look. #include <stdio.h> #include <Windows.h> #include <intrin.h> typedef HMODULE(...
Ox9A82's user avatar
  • 137
1 vote
Accepted

Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?

Here is my final code.. it works.. gets all imports except a missing a few like 10 at most.. which are hardly important anyways. It misses GetCurrentProcessId(),GetCurrentProcess(),LoadLibrary. It ...
SSpoke's user avatar
  • 759
1 vote

FThunks when trying to get IAT

Look in the disassembly listing, you see lots of OUTS which is a sign of junk generated by trying to disassemble random data/bytes => this thunk at RVA 00013800 should be safe to be "cut thunk&...
Minh-Triet Pham Tran's user avatar
1 vote

FThunks when trying to get IAT

As it said above, 419030 points to some data, not the code. So you may just remove this FThunk.
Anton Kukoba's user avatar
  • 1,850
1 vote

FThunks when trying to get IAT

the pointer you are pointing to in your screen shot contains ascii strings do the app use some dll like BCMenu or Windows Classic Theme etc Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E ...
blabb's user avatar
  • 16.4k
1 vote
Accepted

Getting Xrefs to Windows Library Functions in IDA Pro

During debugging, you can use names in format "DllName_export" (e.g. kernel32_CreateFileA) to jump to functions exported by the loaded DLLs, or you can use such names in "symbolic breakpoints" so ...
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible