export forwarding, import by ordinals

Index > Windows > export forwarding, import by ordinals

Author

Thread

asmrox

Joined: 19 Jan 2008
Posts: 160

asmrox 22 Feb 2008, 04:13

1. How should look eat to forward to another dll?
2. how should look iat to import smth by index?

22 Feb 2008, 04:13

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20336
Location: In your JS exploiting you and your system

revolution 22 Feb 2008, 13:00

1. You point the address of the exported function to a string that is inside the export table. This triggers the loader to use the string to import from another module.

2. You put the ordinal number in the first two bytes of the import string. Normally these two bytes would be zeros. They act as a hint if you also include the string, but without a string then they are used directly.

22 Feb 2008, 13:00

asmrox

Joined: 19 Jan 2008
Posts: 160

asmrox 22 Feb 2008, 13:20

second work ok
test_table:
function dd RVA 00000001
dd 0

but first dont. How do i know address of a function from external dll? And... how the program will know the dll?

22 Feb 2008, 13:20

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20336
Location: In your JS exploiting you and your system

revolution 22 Feb 2008, 13:39

in the export address table:

Code:

...
dd RVA func_abc
dd RVA func_jkl_forwarded_string
dd RVA func_xyz
...

in the export names table:

Code:

...
dd RVA func_abc_string
dd RVA func_jkl_string
dd RVA func_xyz_string
...

the export ordinals table is no change

And the names:

Code:

...
func_abc_string: db 'ABC',0
func_jkl_string: db 'JKL',0
func_xyz_string: db 'XYZ',0
;the following name MUST be within the export section or it won't work
func_jkl_forwarded_string: db 'modulename.JKL',0

BTW I don't understand your example, it looks wrong to me

instead of:
dw 0
db 'import',0

you use:
dw ordinal
db 'import',0

or you can use:
dw ordinal
db 0

22 Feb 2008, 13:39

asmrox

Joined: 19 Jan 2008
Posts: 160

asmrox 22 Feb 2008, 14:00

Code:

format pe dll
section '.edata' export data readable
dd 0,0,0,0,1
dd 1,0,RVA e_addr,0,0
e_addr:
dd RVA _forward
_forward db 'user32.MessageBoxA',0

thanks again Smile

22 Feb 2008, 14:00

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum