Reverse Engineering Asked by LighFusion on September 30, 2021
I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll
What can u suggest to solve this ?
Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".
First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll
is just extending Export Directory
and possibly changing some other fields. So, what you have to do is to:
dll
in PE parser. It can be PE Explorer, CFF Explorer or in disassembler such as IDA (tick manual load, and then load all possible sections).dll
. Some changes may be done in above mentioned PE parsers, but not all.ExportDirectory.NumberOfFunctions
by 1
, since you are adding new function.ExportDirectory.NumberOfNames
.Export Address Table
, which is located at ExportDirectory.AddressOfFunctions
. Just use hex editor to insert 4
new NULL bytes - you will set their value when you insert your function's code.ExportDirectory.AddressOfNames
has probably changed (by 4
bytes). You have to adjust it as well.ExportDirectory.AddressOfNames
- insert another 4
bytes using hex editor. Later on, you will change it to the name of your function.ExportDirectory.AddressOfNameOrdinals
and add 2
bytes using hex editor (highest ordinal + 1
, write it in little endian).ExportDirectory.Name
as well, to point to the dll
name.ExportDirectory.AddressOfNames
)..text
section (if it is small enough, you won't have to resize it).Export Directory Size
to match your new size.SectionHeader.VirtualSize
for .edata
section.FileHeader.NumberOfSymbols
by 1
.SectionTable.SizeOfRawData
for ExportDirectory
by number of bytes you have inserted using hex editor, or delete as this number of NULL bytes at the end of ExportDirectory
(if present).OptionalHeader.CheckSum
.As you see, it's a tedious process to do this manually and even if you find doing it too difficult, I hope that at least you see what has to be done "at low level" to add new export to a dll
.
Correct answer by bart1e on September 30, 2021
Get help from others!
Recent Questions
Recent Answers
© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP