The issue I am having is stated as this:
badboy line of code:
HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));
Which is great output but it misses the functions for: (ijl11.dll & libcef.dll)
I have tried:
If I make the HMODULE handle "global", good output but missing output of two dll's.
If I make the HMODULE handle "local to function", good output but missing two dll's.
If I make the HMODULE handle "local to the for loop", good output but missing two dll's.
badboy line of code:
static HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));
The output as "static" gives me the two missing dll's functions.
Question: Why will the use of static give me the output of the two missing dll's functions? While using non-static will not give me the correct output.
Also, why is it that the use of both ways added together of course gives me the output I am looking for?
Conclusion I have so far: The handle has something going on with it.
But the use of non-static gives me great output and the use of static gives me crap output but gives me the output for the two missing dll's import functions.
I don't get it. Can someone explain please?
The code:
// Custom Module Struct
typedef struct
{
PIMAGE_NT_HEADERS NT_Headers;
unsigned char *codeBase;
HMODULE *modules;
int numModules;
int initialized;
} MEMORYMODULE, *PMEMORYMODULE;
//HMODULE handle;
int BuildImportTable(PMEMORYMODULE module)
{
int result = 1;
//HMODULE handle;
unsigned char *codeBase = module->codeBase;
PIMAGE_DATA_DIRECTORY directory = GET_HEADER_DICTIONARY(module, IMAGE_DIRECTORY_ENTRY_IMPORT);
printf("Directory Size: %d\n", directory->Size);
if (directory->Size > 0)
{
PIMAGE_IMPORT_DESCRIPTOR importDesc = (PIMAGE_IMPORT_DESCRIPTOR)(codeBase + directory->VirtualAddress);
// Check Each Import Descriptor
for (; !pIsBadReadPtr(importDesc, sizeof(IMAGE_IMPORT_DESCRIPTOR)) && importDesc->Name; importDesc++) {
// loop scope
PIMAGE_THUNK_DATA thunkILT;
PIMAGE_THUNK_DATA thunkIAT;
// Load Each Library By Name
printf("\n\n\n[BuildImportTable]: Trying To Load: %s\n", codeBase + importDesc->Name);
static HMODULE handle = (HMODULE)pLoadLibraryA((LPCSTR)(codeBase + importDesc->Name));
if (handle != NULL){
printf("[BuildImportTable]: Loaded: %s\n", codeBase + importDesc->Name);
}
if (handle == INVALID_HANDLE_VALUE) {
result = 0;
printf("[BuildImportTable]: Handle NULL\n");
break;
}
//// Build Out Module Structure Members
//HMODULE *p = (HMODULE*)MemRealloc( module->modules, (module->numModules + 1) * ( sizeof(HMODULE) ) );
//module->modules = p;
//if (module->modules == NULL) {
// result = 0;
// printf("[BuildImportTable]: Modules NULL\n");
// break;
//}
//// Store Allocated Library
//module->modules[module->numModules++] = handle; // Load Library Handle
// OriginalFirstThunk - Names are stored in ILT.
if ( importDesc->OriginalFirstThunk ) {
// Get RVA of the Import Lookup Table (ILT)
thunkILT = (PIMAGE_THUNK_DATA)(importDesc->OriginalFirstThunk);
if (thunkILT == NULL) { printf("[BuildImportTable]: thunkILT RVA NULL\n"); continue; }
// Get VA to (ILT)
thunkILT = (PIMAGE_THUNK_DATA)( codeBase + importDesc->OriginalFirstThunk);
if (thunkILT == NULL) { printf("[BuildImportTable]: codeBase + thunkILT RVA NULL\n"); continue; }
// Offset Linear Address to get valid data
//thunkILT = (PIMAGE_THUNK_DATA)rvaToPtr( (DWORD)thunkILT, module->NT_Headers, (DWORD)codeBase );
}
// FirstThunk - ( i.e., the array of linear addresses built by the loader ).
if (importDesc->FirstThunk){
// The RVA of the Import Address Table (IAT)
thunkIAT = (PIMAGE_THUNK_DATA)(importDesc->FirstThunk);
if (thunkIAT == NULL) { printf("[BuildImportTable]: thunkIAT RVA NULL\n"); continue; }
// Get VA to (IAT).
thunkIAT = (PIMAGE_THUNK_DATA)(codeBase + importDesc->FirstThunk);
if (thunkIAT == NULL) { printf("[BuildImportTable]: codeBase + thunkIAT RVA NULL\n"); continue; }
}
while( (thunkILT->u1.AddressOfData != 0) || thunkILT->u1.Ordinal != 0 )
{
if ( IMAGE_SNAP_BY_ORDINAL(thunkILT->u1.Ordinal) ) {
// BY ORDINAL
printf("[BuildImportTable]: OLD thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
/*HMODULE hModule = GetModuleHandle((LPCSTR)(codeBase + importDesc->Name));
if (hModule != NULL){*/
thunkIAT->u1.Function = (DWORD)pGetProcAddress(handle, (LPCSTR)IMAGE_ORDINAL(thunkILT->u1.Ordinal));
if (thunkIAT->u1.Function == NULL){
printf("[BuildImportTable]: Procedure Not Found By Ordinal\n");
printf("[BuildImportTable]: HMODULE: 0x%08X ERROR: %d\n", handle, GetLastError());
thunkILT++;
break;
}
printf("[BuildImportTable]: NEW thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
printf("[BuildImportTable]: Ordinal: 0x%08X\n", thunkILT->u1.Ordinal);
thunkILT++;
//}
//else{
// printf("[BuildImportTable]: HMODULE: 0x%08X ERROR: %d\n", hModule, GetLastError());
// thunkILT++; break; }
} else {
// if statement scope
PIMAGE_IMPORT_BY_NAME NameData;
NameData = (PIMAGE_IMPORT_BY_NAME)( thunkILT->u1.AddressOfData );
if (NameData == NULL) { printf("[BuildImportTable]: NameData RVA NULL\n"); break; }
NameData = (PIMAGE_IMPORT_BY_NAME)( codeBase + thunkILT->u1.AddressOfData );
if (NameData == NULL) { printf("[BuildImportTable]: codeBase + NameData RVA NULL\n"); break; }
// BY NAME
printf("[BuildImportTable]: OLD thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
thunkIAT->u1.Function = (DWORD)pGetProcAddress(handle, NameData->Name);
if (thunkIAT->u1.Function == NULL){ printf("[BuildImportTable]: Procedure Not Found By Name\n"); break; }
printf("[BuildImportTable]: NEW thunkIAT->Function: 0x%08X\n", thunkIAT->u1.Function);
printf("[BuildImportTable]: ThunkData->Name: %s\n", NameData->Name);
thunkILT++;
}
// CHECK NEW IAT
if ( thunkIAT == 0 ) {
result = 0;
printf("[BuildImportTable]: NEW IAT NULL\n");
break;
}
// Increment
thunkIAT++;
} // End of Thunk Loop
} // End of for Loop
} // Director Size
_getch();
return result;
}
