I found a way to get rid of 2, seemingly unnecessary, extra bytes at the front of each imported function. In the import macro, inside macro\import.inc, I changed:
label dd RVA _label
to
label dd RVA _label-2
and
_label dw 0
db string,0
to
_label db string,0
to get:
macro import name,[label,string]
{ common
name:
forward
if used label
if string eqtype ''
local _label
label dd RVA _label-2
else
label dd 80000000h + string
end if
end if
common
if $ > name
name#.redundant = 0
dd 0
else
name#.redundant = 1
end if
forward
if used label & string eqtype ''
_label db string,0
end if }
I'm not very experienced with macros or the structure of PE's, but this seems to work alright. Why were those 2 bytes there? Are there any reasons to not use this new way?
Index
> Windows > import macro improvement?
19 Jun 2004, 21:48