Index
> Windows > Question regarding the IAT |
| Author |
|
|
revolution 11 Sep 2009, 22:10
It depends upon how you format your IAT. If you use the standard fasm header macros then the call will take the MessageBox address directly from the IAT entry. The IAT entry is initialised by the Windows loader and at runtime the address is absolute.
|
|||
11 Sep 2009, 22:10 |
|
|
Icefex 12 Sep 2009, 05:30
I'm aware of it how it is after loading but how is it just in the binary image? I wanted to know if the address after the call is an RVA or not.
|
|||
|
12 Sep 2009, 05:30 |
|
|
revolution 12 Sep 2009, 05:39
TFM wrote: CALL r/m32 - Call near, absolute indirect, address given in r/m32. |
|||
|
12 Sep 2009, 05:39 |
|
|
Icefex 12 Sep 2009, 16:42
Sorry to be annoying but this address then points to the entry in the IAT which contains after loading the address of the function and the address of the call points absolute in means of the executable image in memory and not whole memory?
|
|||
|
12 Sep 2009, 16:42 |
|
|
vid 12 Sep 2009, 19:51
it is RVA of 2byte ordinal, followed by ASCIIZ string name of function (eg. FirstThunk array in binary is identical to OriginalFirstThunk array)
|
|||
|
12 Sep 2009, 19:51 |
|
|
Icefex 12 Sep 2009, 20:16
Okay, I'm trying to make it more clear:
call [MessageBoxA] after assembly -> FF 25 00 00 00 00 where does 00000000 point? Does it point to the entry in the IAT which contains the address of the function after loading the pe? And if, is this address (the 00000000) absolute to the whole memory or only the image in memory? (I know that the entry in the IAT after loading is containing the function address) |
|||
|
12 Sep 2009, 20:16 |
|
|
Fanael 12 Sep 2009, 20:38
00000000 is null pointer and is ALWAYS invalid. Probably your code contains errors, or you're compiling to COFF, then that address will be updated by the linker.
|
|||
|
12 Sep 2009, 20:38 |
|
|
Icefex 13 Sep 2009, 04:58
Meh. That pointer was just to show what i wanna know. My files compile and run fine...
Okay here is what I wanna do: I'm trying to make a program which removes the .idata section. It first searches for all addresses which are called by the program and stores them in an array, then goes through the code, searches for the opcodes FF 25 and FF 15, looks up the address in the previously generated table and if it matches it replaces it with an identifier for the dll and an function hash. And then patches a new section to the exe and removes the .idata. Okay and my only problem in this to verify the function calls. |
|||
|
13 Sep 2009, 04:58 |
|
|
revolution 13 Sep 2009, 05:11
Have a look at the file "PEDEMO.ASM" in the "examples\pedemo\" folder of the download zip.
Code: ... call [MessageBoxA] ... MessageBoxA dd RVA _MessageBoxA ... _MessageBoxA dw 0 db 'MessageBoxA',0 |
|||
|
13 Sep 2009, 05:11 |
|
|
Icefex 13 Sep 2009, 06:12
Okay, then it's an RVA, thanks...
|
|||
|
13 Sep 2009, 06:12 |
|
|
vid 13 Sep 2009, 13:10
Icefex wrote: Okay, then it's an RVA, thanks... As I said in 5 posts ago 
But note that there are other common ways of calling API used by compilers: Code: call MessageBoxA ... mov esi, MessageBoxA call esi ... MessageBoxA: jmp [__imp__MessageBoxA] ... __imp__MessageBoxA dd rva MessageBoxA_thunk ... MessageBoxA_thunk: dw 0 db "MessageBoxA", 0 |
|||
|
13 Sep 2009, 13:10 |
|
|
Icefex 13 Sep 2009, 13:13
Yes I know, so called jumppads, but they are not my problem. I also got the source of a pe loader of a friend so I think I have enough info to do it now.
|
|||
|
13 Sep 2009, 13:13 |
|
|
vid 13 Sep 2009, 15:21
Also note the loading of API address to register for multiple calls. That is common as well.
|
|||
|
13 Sep 2009, 15:21 |
|
< Last Thread | Next Thread > |
Forum Rules:
|