TransWikia.com

Pe 32 Add Export function Segment by Extending with dll or Patching pe

Reverse Engineering Asked by LighFusion on September 30, 2021

I need to add new function inside pe32 module.dll Export Table , in dynamic way if possible ( via extending with dll ) or by patching pe32 module.dll

What can u suggest to solve this ?

One Answer

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand".

First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, what you have to do is to:

  1. Open your dll in PE parser. It can be PE Explorer, CFF Explorer or in disassembler such as IDA (tick manual load, and then load all possible sections).
  2. Open your favourite hex editor in order to patch dll. Some changes may be done in above mentioned PE parsers, but not all.
  3. Increase ExportDirectory.NumberOfFunctions by 1, since you are adding new function.
  4. Do the same thing with ExportDirectory.NumberOfNames.
  5. Now, you have to add new entry to Export Address Table, which is located at ExportDirectory.AddressOfFunctions. Just use hex editor to insert 4 new NULL bytes - you will set their value when you insert your function's code.
  6. After previous step, ExportDirectory.AddressOfNames has probably changed (by 4 bytes). You have to adjust it as well.
  7. Now, insert new entry to ExportDirectory.AddressOfNames - insert another 4 bytes using hex editor. Later on, you will change it to the name of your function.
  8. As in step 6. and 7., adjust ExportDirectory.AddressOfNameOrdinals and add 2 bytes using hex editor (highest ordinal + 1, write it in little endian).
  9. Since you have inserted several new bytes, you have to change ExportDirectory.Name as well, to point to the dll name.
  10. Now, insert your function's name at the end of the table of function names (last entry in ExportDirectory.AddressOfNames).
  11. Set the entry you have created in 7. so it points to your function name.
  12. Insert your function's code at the end of .text section (if it is small enough, you won't have to resize it).
  13. Set the entry you have created in 5.
  14. Change Export Directory Size to match your new size.
  15. Use the same value for changing SectionHeader.VirtualSize for .edata section.
  16. Increase FileHeader.NumberOfSymbols by 1.
  17. Either increase SectionTable.SizeOfRawData for ExportDirectory by number of bytes you have inserted using hex editor, or delete as this number of NULL bytes at the end of ExportDirectory (if present).
  18. Zero out or compute new OptionalHeader.CheckSum.

As you see, it's a tedious process to do this manually and even if you find doing it too difficult, I hope that at least you see what has to be done "at low level" to add new export to a dll.

Correct answer by bart1e on September 30, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP