Export table tweaks

Index > Windows > Export table tweaks

Goto page 1, 2 Next

Author

Thread

AlexP

Joined: 14 Nov 2007
Posts: 561
Location: Out the window. Yes, that one.

AlexP 26 Mar 2008, 02:09

I have a function that performs both encryption and decryption the same, but to conform to the others I would like to have two names for it, one for both encryption and decryption. Could I do this?:

Code:

export 'MyDLL.dll',\
    function,'FunctionEncrypt',\
    function,'FunctionDecrypt'

I wouldn't like to break any sort of standard, but which choice should I make?

26 Mar 2008, 02:09

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 26 Mar 2008, 02:34

Sure you can do that. It is only a pointer there are no special requirements about duplication.

26 Mar 2008, 02:34

itsnobody

Joined: 01 Feb 2008
Posts: 93
Location: Silver Spring, MD

itsnobody 26 Mar 2008, 20:40

yeah there's no problems with this, you can do it, make sure the export names are in alphabetical order though....having it not in alphabetical order may cause problems

26 Mar 2008, 20:40

AlexP

Joined: 14 Nov 2007
Posts: 561
Location: Out the window. Yes, that one.

AlexP 26 Mar 2008, 23:30

Yeah, but I was just wondering if it was proper to do Smile

I'll probably end up having only one, and making a good note of it in the header to avoid confusion from the user. THanks!

26 Mar 2008, 23:30

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 06:33

Quote:

having it not in alphabetical order may cause problems

what kind of problems you encountered? May be it's just recommendation to arrange alphabetically?

27 Mar 2008, 06:33

AlexP

Joined: 14 Nov 2007
Posts: 561
Location: Out the window. Yes, that one.

AlexP 27 Mar 2008, 07:30

I highly doubt that Windows would trust every library to have their exported strings in alphabetical order, or many would have encountered those problems..

27 Mar 2008, 07:30

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 27 Mar 2008, 08:01

AlexP wrote:

I highly doubt that Windows would trust every library to have their exported strings in alphabetical order, or many would have encountered those problems..

The default macros in the fasm download will sort the export strings for you so that is why you don't see the problem. If you didn't use the macros and also didn't manually sort your strings then you can have problems.

27 Mar 2008, 08:01

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 08:07

From MS PE & COFF documentation.

Quote:

6.3.3. Export Name Pointer Table
The export name pointer table is an array of addresses (RVAs) into the export name table. The pointers are 32 bits each and are relative to the image base. The pointers are ordered lexically to allow binary searches.
An export name is defined only if the export name pointer table contains a pointer to it.

27 Mar 2008, 08:07

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 27 Mar 2008, 08:14

Hehe, if all else fails RTFM. Thanks for posting that asmfan Smile

27 Mar 2008, 08:14

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 08:31

But notice: not a word like "must", "should" be ordered lexically... Then I can think the order only have enfluence on speed.

27 Mar 2008, 08:31

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 27 Mar 2008, 09:01

asmfan wrote:

But notice: not a word like "must", "should" be ordered lexically... Then I can think the order only have enfluence on speed.

It is not possible to do a binary search on unsorted data, so it is implied that the exports must be sorted else you will be sorry.

27 Mar 2008, 09:01

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 09:52

Actually I always thought Win loader searches among every entry in export table not only till the first letter of next export func. name greather lexically than the letter of nedded name.
(too lazy moment to make any tests on unsorted lists of export funcs)

27 Mar 2008, 09:52

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 10:24

Just made some tests: unsorted export table works perfectly on both static linking & dynamic dll linking. Tested on Win 32-bit XP SP2+. Still no "must" word met.

27 Mar 2008, 10:24

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 27 Mar 2008, 10:55

Okay, now please test with Win95 Win98, WinNT, Win2K, WinVista all versions and all patch levels. Also remember to keep testing for all future versions to be sure that MS don't screw it up some time later by deciding to enforce it due a lame "for security reasons" excuse.

Seriously, I think it would be easier to just use the macros and sort the table, then there is no need to worry about any future/past incompatibility.

27 Mar 2008, 10:55

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 11:41

Some times I hate MS documentation cuz it sometimes lacks those keywords like "must" and othert. For example - lots of Native APIs take structures as parameters but nowhere you can find that the structure "must" be aligned on 4 or more and this leads to dummy mistakes. Of course we now that performance suffers because of misalignment but nowhere you meet "must". E.g. NtQueryPerformanceCounter (and its not Nt* analog) takes only 4 bytes aligned data. Of course it's natural alignment but where it's said to align data so?

27 Mar 2008, 11:41

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20339
Location: In your JS exploiting you and your system

revolution 27 Mar 2008, 12:14

I think the reason that alignment is not mentioned in the docs is because they are aimed at HLL programmers (note all the C examples in the SDK) and they expect the HLL compiler to have nicely aligned things on the natural boundaries.

27 Mar 2008, 12:14

f0dder

Joined: 19 Feb 2004
Posts: 3175
Location: Denmark

f0dder 27 Mar 2008, 15:03

asmfan: did you make a large number of exports, very scrambled, and did you import all those exports from your test exe?

Last time I checked, export-sorting was necessary on XP SP2.

27 Mar 2008, 15:03

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 17:22

Nope, just imported 1 proc. which is the last in export table containing 4/5 scrambled exports in dll. A bit later I'll test it more according your advice with multiple imports from dll.

27 Mar 2008, 17:22

asmfan

Joined: 11 Aug 2006
Posts: 392
Location: Russian

asmfan 27 Mar 2008, 18:47

Again worked fine addresses found by loader both statically and dynamically.

27 Mar 2008, 18:47

itsnobody

Joined: 01 Feb 2008
Posts: 93
Location: Silver Spring, MD

itsnobody 27 Mar 2008, 20:52

asmfan wrote:

Quote:

having it not in alphabetical order may cause problems

what kind of problems you encountered? May be it's just recommendation to arrange alphabetically?

A while back I was having problems with it, I was using an older version of FASM and couldn't figure out what was wrong with the DLL why some people couldn't get it to work, then I put the export names in alphabetical order and it worked

I don't know if FASM automatically does this now...

27 Mar 2008, 20:52

Goto page 1, 2 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum