<data section>
_b dd CS_Print

<import section>
library _Lib, 'msvcrt.dll'
import _Lib, CS_Print, 'printf'

for some reason _b does not equate to CS_Print when the program starts, I guess I'm not sure exactly how to correctly get its value?

Any help appreciated

CS_Print is not an address of imported function, it is an address of a 32-bit data field that contains an address of a function once the imports have been resolved. You call the function indirectly through this variable: This field is filled with a correct address only at run-time, after PE loader has processed the imports.

Therefore if you need [_b] to have the address of imported function, you have to copy the value like:

thank you for your answer it's much appreciated.

It turns out _b stored the address of CS_Print rather than matching it (obviously)

So I needed to alter my code to this:


In order to actually call the correct address, and as you have mentioned I need to copy it at the start of the program to get the correct value (without needing to go through extra instructions).

Thanks