|
|
#2
01-11-2005, 16:11
|
|||
|
|||
|
The programs that use some APIs, have import table that points to the name & module of needed APIs .
At the runtime, the loader (Operating system) loads appropriate modules (such as Kernel32, User32 & GUI32) and fills the entries of this table with the current address of APIs in the memory. In the packed or encrypted programs, the unpacker routine that runs at the start of the program, performs this operation. This routine first loads the module with LoadLibray() API and then finds the address of desired APIs by calling GetProcAddress(). If you can not remove this unpacking routine, you should use other hooking techniques such as DLL injection. 
|
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Add imports to DLL import table | jonwil | General Discussion | 5 | 09-07-2020 16:47 |
| How to shuffle names in the PE import table? | Newbie_Cracker | General Discussion | 5 | 08-25-2019 03:59 |
| Reliable PE Library or DLL for Adding Functions to Import Table | omidgl | General Discussion | 3 | 06-28-2008 09:53 |
| Can`t restore import table | thechatter | General Discussion | 9 | 11-14-2003 21:01 |
| Changing Import Table?? | magic | General Discussion | 3 | 09-14-2003 01:59 |
Threaded Mode