Creating an export table

[Nacho_dj]

Hello:

I would like to patch in memory an application, in order to configure an export table. Then I could use it to import some functions from an external application, in order to use some code of the patched application.

First, I launch the application with a loader. The application is packed.
When it is loaded, I write in the memory of the target process the configuration of the entire export table.

When trying to import some functions of that export table with the loader, I do the following:

I do LoadLIbrary of that application (it is an .exe file), then I want to GetProcAddress some functions of that table.

However, this is not working. Not providing any handle but nil.

I do not understand why. Maybe it is because the export table couldn't be created patching in memory when the process is already loaded.

Do you have suggestion? Is it a better way to do that? I do not know if this could be performed with hooks...

Cheers


Nacho_dj

I'm suspecting it's because LoadLibrary is reloading the file from disk, and thus hence not seeing your newly added "section".

What you should try next, as an experiment, it simply passing the memory address of the now loaded packed exe to GetProcAddress. If you are observant enough in your debugging you may have noticed that LoadLibrary returns to you the very Virtual Address of where the file LoadLibrary called was loaded! Which means GetProcAddress then also takes in a pointer directly to the EXE/DLL header. GetProcAddress does a normal export or import table lookup like you would do in your own code were you to write a DLL export scan tool.

So attempt to simply just pass the address of the loaded application.

Remember as well that you cannot use LoadLibary and GetProcAddress across process boundaries ! If you called "LoadLIbrary" inside your loader, and it's an actual seperate program, you will get the "library" which is on disk of course. Which explains why you have no export table.

If the loader and the EXE share the same process however, you should be able to simply pass the VA of the EXE that got loaded into GetProcAddress.


-Lunar

[Nacho_dj]

Hi Lunar Dust:

Thanks for your answer.

You're right, it is as you have mentioned. LoadLibrary takes the file in the hard disk, not the process already launched. So, no patched export table appears.

And there is some more. As the file is a packed .exe, it loads with LoadLibrary without being unpacked, so no code available inside it.

I wonder if CreateProcess could launch the new process in the same memory area that the loader owns, that is, in the same loader process. This would be what I need.
Then, I think it will be easier patching an export table in the loaded process inside the loader process and then accessing the functions exported by the new process.

Anyway, for now I have got two independant processes and therefor no possibilities of accessing from the loader to the code of the loaded application.

I was thinking about let the loader patch totally the application and then when dumped, do a LoadLibrary in order to access that piece of code that is performing the required function.
But I think there could be a better solution than this. If there is a process in memory, won't it exist an easier way?


Cheers


Nacho_dj

Well, what do u think the Export Table Values in the PE-Header are for?
You can patch in an Export table,but i guess you wont be able to get hold of any Exports that easy then..

Why dont u put your stuff in some DLL and inject some code to load that DLL instead?
This would enable you to code all stuff you need in your dll without any relying on the original code, just create the proc and inject some pseudo dll-loader code in the apps context..

cheers

[Nacho_dj]

Thank you NtSC:

Maybe that is the only one thing I could do to perform what the code is doing in the process.

I have to test it. I am trying now to code all that the original program does in that routine of my interest, but it is a little bit hard.

Cheers

Nacho_dj

i happened to remeber some thing i read vaguely but now i neither can find a link or google for it
but have you tried to use those NtCreateSection ZwMapViewOfSection
and load of other undocumented API
the article i speak of was a pdf and it happened to do some thing like
loading a file from memory (included some linux mmap routines too not from disc)
using the above apis

Maybe this could be interesting: hxxp://www.anticracking.sk/EliCZ/infos/SEHall.zip