Creating an export table

[Nacho_dj]

Hello JuneMouse:

It seems that all those functions are related to files. But when talking about processes in memory...

I have found these links:
http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Section/NtCreateSection.html

http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/NT%20Objects/Section/NtMapViewOfSection.html

http://www.sysinternals.com/Information/NativeApi.html

The last URL shows api's that could perform tasks of loading sections of file, but I cannot find any speaking about loading "pieces of code" in memory from another process in the loader process.

Anyway, many thanks for your suggestion

Cheers

Nacho_dj

i just found the pdf its called remote library injection
authours are skape and jt

you should find it in nologin.org papers section
i am not providing a direct link because i would also like you to
take a look on other papers there as well
some just run above head but neverthless a good read

hope you get together some ideas from there

Maybe you could create an additional Section. Then change the EP to this section. You can create a structured Exception Handler there. After you have done this you can set int3's into the unpacking code and then jump back to the EP. You gain control of the code whenever a int3 ist reached. Of course you could also place other illegal Instructions like XOR EAX, EAX - MOV [EAX], EAX, but int3s are much smaller and you don't need to write so much code back. If the programm creates structured Exception Handlers itself it is much more difficult to find the right places to patch.

EDIT: It is also possible to change the values of the registers or on the stack.

[Nacho_dj]

Hello:

Junemouse, I just have downloaded the pdf, I will take a slow reading of it.

Messer, it seems interesting, and a new good point of view, but I have never read anything about "structured Exception Handler". Do you know a good document to work on it?

Thanks for your help

Nacho_dj

[Hero]

Structured exception handler(SEH) is a way for handling exceptions!
You surely seen codes like this in many programs:

push offset handler
push fs:[0]
mov fs:[0],esp
....
pop fs:[0]
add esp,4
ret
handler:
....
mov eax,1
ret

This is a SEH.
If you know rusian,or you will use online translators like babelfish,You can use these tutorials:
http://wasm.ru/article.php?article=Win32SEHPietrek1
http://wasm.ru/article.php?article=Win32SEHPietrek2
http://wasm.ru/article.php?article=Win32SEHPietrek3
or else you can use web site that I attached(I don't remember its URL) for a great tutorial.
In addition I don't forget when I asked the same question here(or woodmann),and get a blame from JMI!

sincerely yours

[Nacho_dj]

Hi Hero:

Very nice of you providing me all this help

I have just downloaded your info, (sorry I do not know a word of russian ) but anyway I will try to translate it as you mentioned. I will read it, sure!

Maybe I have seen that code you are referring in certain debugging session, but now I am sure I didn't know what was happening there

Thanks for all.

Have a good day mate!

Cheers

Nacho_dj