Creating an export table

[Nacho_dj]

Hi Lunar Dust:

Thanks for your answer.

You're right, it is as you have mentioned. LoadLibrary takes the file in the hard disk, not the process already launched. So, no patched export table appears.

And there is some more. As the file is a packed .exe, it loads with LoadLibrary without being unpacked, so no code available inside it.

I wonder if CreateProcess could launch the new process in the same memory area that the loader owns, that is, in the same loader process. This would be what I need.
Then, I think it will be easier patching an export table in the loaded process inside the loader process and then accessing the functions exported by the new process.

Anyway, for now I have got two independant processes and therefor no possibilities of accessing from the loader to the code of the loaded application.

I was thinking about let the loader patch totally the application and then when dumped, do a LoadLibrary in order to access that piece of code that is performing the required function.
But I think there could be a better solution than this. If there is a process in memory, won't it exist an easier way?


Cheers


Nacho_dj