how call api without import section?

I actually wrote about one method fairly recently:

lucifer wrote:

DOS386 wrote:
search for "noimport" http://board.flatassembler.net/topic.php?t=7718
A bit off topic but that code snippet isn't the best. I hate it when the first thing a program does is use a stupid loop to get the base address of kernel32.dll. You can do it in two instructions and it works on all Windows platforms as far as I have tested! When the loader calls your entry point eax is a pointer inside kernel32.dll that is just a single page away from the base of kernel32.dll which is page aligned (another cool trick is that ebx is loaded with the address to the PEB when the loader calls the entry point)
Code:
xor      ax, ax      ; align eax pointer to page boundaries
sub     eax, 10000h  ; roll back a page. eax is now equal to kernel32.dll base    
Anyway... it utilizes a lot of registers but this is something that I wrote that was the first thing my program did so I didn't need them for anything else yet
Code:
;; Assuming that eax contains the pointer to the DOS header of the module
mov     ebx, eax            ; ebx = k32 base addr
mov     edx, eax
add     eax, [eax + 3Ch]    ; eax = ptr to pe header
add     edx, [eax + 78h]    ; edx = ptr to data directory
mov     ecx, [edx + 18h]    ; ecx = number of function names
mov     eax, [edx + 1Ch]
add     eax, ebx            ; eax = address of functions
mov     edx, [edx + 20h]
add     edx, ebx            ; edx = address of names    
It's easy from there just google about the export table!

also its my first post ;o

From there you just get the imports of GetProcAddress and LoadLibraryA and use those. If you wanted to use the native interface you can always get the the address of some code in ntdll.dll off of the stack but I don't know how many pages away it is from the base of the module. Since it may not be fixed like with kernel32.dll you might have to loop back pages to be compatible across all Windows installations. Quickly hacking something up in C you could do this:

Code:

short *base = <some ptr into ntdll.dll from stack (a return address)>
for(base &= 0xFFFF0000; *base != 'ZM'; base -= 0x10000)
    if (base <= 0)
        <you gave me a bad pointer :D>

Then walk the headers again and find the appropriate exports via binary search, comparing hashes, linear string search etc

Of course there are other ways but that one is my favorite. The most popular way is probably going through a pointer inside the PEB. Search around Smile