From 5d93f86b4bfc401f2829ff405fb589a0558d843f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C3=A1szl=C3=B3=20Moln=C3=A1r?= Date: Mon, 10 Mar 2014 21:42:11 +0100 Subject: [PATCH] armpe_tester: better import handling --- src/stub/tools/armpe/armpe_tester.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/src/stub/tools/armpe/armpe_tester.c b/src/stub/tools/armpe/armpe_tester.c index 60367eee..d1bbb14a 100644 --- a/src/stub/tools/armpe/armpe_tester.c +++ b/src/stub/tools/armpe/armpe_tester.c @@ -303,9 +303,20 @@ static int import(void) { void *coredll_imports = vaddr + get_le32(imports + 16); print("coredll_imports=%p\n", coredll_imports); - set_le32(coredll_imports + 8, (unsigned) loadlibraryw); - set_le32(coredll_imports + 4, (unsigned) getprocaddressa); - set_le32(coredll_imports + 0, (unsigned) cachesync); + void *oft = vaddr + get_le32(imports); + unsigned pos = 0; + while (get_le32(oft + pos)) + { + void *name = vaddr + get_le32(oft + pos) + 2; + print("name=%s\n", (char*) name); + if (strcasecmp(name, "loadlibraryw") == 0) + set_le32(coredll_imports + pos, (unsigned) loadlibraryw); + else if (strcasecmp(name, "getprocaddressa") == 0) + set_le32(coredll_imports + pos, (unsigned) getprocaddressa); + else if (strcasecmp(name, "cachesync") == 0) + set_le32(coredll_imports + pos, (unsigned) cachesync); + pos += 4; + } return 0; } imports += 20;