| Author | Message | Time |
|---|---|---|
| BreW | Well? How do I do it? I know that one of the elements of the DataDirectory[16] array (the last member of the PE32OptHeader struct) contains an RVA to the exports section but i really have no idea what one. help please! If i can find the correct one, i can add the base address of the dll with the export table's RVA then get the address of the IMAGE_EXPORT_DIRECTORY struct... then i can get to the EAT. | December 23, 2007, 3:22 AM |
| HdxBmx27 | If i recall correctly, IMAGE_DIRECTORY_ENTRY_EXPORT is the 1st element of that array. so the *DataDirectory = Pefile.DataDirectory[0].VirtualAddress *DataExportDir = DataDirectory.VirtualAddress Then DataExportDir.AddressOfFunctions Something like that. Can't think straight. ~Hdx | December 25, 2007, 5:32 PM |
| BreW | [quote author=Hdx link=topic=17231.msg175502#msg175502 date=1198603974] If i recall correctly, IMAGE_DIRECTORY_ENTRY_EXPORT is the 1st element of that array. so the *DataDirectory = Pefile.DataDirectory[0].VirtualAddress *DataExportDir = DataDirectory.VirtualAddress Then DataExportDir.AddressOfFunctions Something like that. Can't think straight. ~Hdx [/quote] Thanks, hdx. | December 27, 2007, 6:38 PM |