How to shuffle names in the PE import table?

[chants]

Yes I had thought the relocations would need to be fixed as well. I was not sure if there was a novel way to change the name addresses without doing so. Anyway the PE file format is reasonably well documented so I think fixing imports and relocations is still not overly difficult.

But I would challenge to try DUMPBIN /EXPORTS on kernel32.lib and see if the order is in the same order the executable table is compiled with. It might not be but it would seem likely otherwise the linker has some strange ordering algorithm - if it enumerates a hash table for example it would seemingly have no rational logic behind the order. Certainly doubtful a setting exists for this as it is a detail that is supposed to be encapsulated in file format internals. As for the order of the libs themselves, I think that would be determined by the order specified in the project settings presumably. Again hash table enumeration is always possible. All of these details are up to the linker type of things.

Maybe could remake a .lib file to reorder the exports, but doubtful that it is worth the effort and as alluded might not even work.

[Newbie_Cracker]

Originally Posted by chants

Maybe could remake a .lib file to reorder the exports, but doubtful that it is worth the effort and as alluded might not even work.

I was thinking about patching the linker to shuffle the orders of APIs; but I don't know if it is possible.