Add dll to import table

  Can use AsmResolver to inject a dll function into the import table. For example, a simple 64bit dll:

code

#include "pch.h"
extern "C" __declspec(dllexport) void puts()
{
    MessageBoxA(0, "hi", "hello", 0);
    return;
}

BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        puts();
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

I want to add the export function "puts" to the IAT of notepad.

Dll1.zip

Can you give some hints or piece of code

[Washi1337]

Like I mentioned in the previous post, make sure you add both the import lookup as well as the import address table to your PE, and that you update the data directories accordingly.

(Incomplete) example:

// Read raw PE file. 
var file = PEFile.FromFile("notepad.exe");
var image = PEImage.FromFile(file);

// Create new import
var module = new ImportedModule("Dll.dll");
module.Symbols.Add(new ImportedSymbol(0, "puts"));
image.Imports.Add(module);

// Reconstruct import dirs
var buffer = new ImportDirectoryBuffer(file.OptionalHeader.Magic == OptionalHeaderMagic.Pe32);
foreach (var m in image.Imports)
    buffer.AddModule(m);

// Build up new section
var sectionBuilder = new SegmentBuilder();
sectionBuilder.Add(buffer.ImportAddressDirectory);
sectionBuilder.Add(buffer, 4);

var section = new PESection(".asmres",
    SectionFlags.ContentInitializedData | SectionFlags.MemoryRead | SectionFlags.MemoryWrite
    | SectionFlags.MemoryExecute);
 
section.Contents = sectionBuilder;

// Add it.
file.Sections.Add(section);

// Update data dirs.
file.AlignSections();
file.OptionalHeader.DataDirectories[(int) DataDirectoryIndex.ImportDirectory]
    = new DataDirectory(buffer.Rva, buffer.GetPhysicalSize());
file.OptionalHeader.DataDirectories[(int) DataDirectoryIndex.IatDirectory]
    = new DataDirectory(buffer.ImportAddressDirectory.Rva, buffer.ImportAddressDirectory.GetPhysicalSize());

// Save
file.Write("notepad2.exe");

https://asmresolver.readthedocs.io/en/latest/peimage/pe-building.html

[laomms]

I use a new dll test the code in other pe, It doesn’t work.But it doesn’t matter, you can close this issue.