Lightweight PE / DLL Export Address Table (EAT) Parser in C++

PE Format & Linker Tech

VIP

Rep: 350

Join Date: Jun 2023

Posts: 35

Thanks: 95

2y ago · Mar 21, 2024 5:37 PM

Parsing IMAGE_EXPORT_DIRECTORY to resolve exported function addresses by ordinal or string hash without calling GetProcAddress.

PEHeader | IMAGE_NT_HEADERS & Section Parsing

The following users thanked PEHeader for this post:

Pattern Scanning & IDA

MEMBER

Rep: 210

Join Date: Jul 2023

Posts: 25

Thanks: 52

2y ago · Mar 22, 2024 12:21 AM

Iterating AddressOfFunctions, AddressOfNames, and AddressOfNameOrdinals in PE memory.

SigScannerPro · Pattern scanning & Byte masking

SDK & Class Builder

MEMBER

Rep: 160

Join Date: May 2024

Posts: 26

Thanks: 39

2y ago · Mar 24, 2024 3:21 AM

Forwarded exports (e.g. NTDLL.RtlAllocateHeap) require recursive module lookup when the export RVA points inside the export directory!

StructMapper | ReClass.NET & Class Layouts

Destination Subforum

Thread Prefix

Thread Title

Post Content (BBCode Enabled)

File Attachment

UnreliableCode Community