📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Extending an Application Using a Non-referenced API

Topic created on: August 7, 2007 14:41 CDT by JLeCours .

I would like to extend ( upgrade? ) an existing application that uses the AllocateAndGetTcpExTableFromStack API, which is deprecated in Vista.  I've been told the proper alternative is to use the GetTcpTable or GetExtendedTcpTable calls.  I'm wondering if anyone knows of a good tutorial on adding additional references to apis to an existing executable.  I imagine it would just be a single IAT entry ( since both apis are within the iphlpapi.dll library ), however I'm not sure how comfortable I would be adding my own thunk.  Any guidance or reference to a tool that could assist me we be great.  Thanks in advanced!

  jms     August 7, 2007 14:57.28 CDT
Well I am sure you could merely hook those calls (using Madshi library maybe?), and proxy them through to the real calls. As long as the return types are the same or you can at least convert them to be the same you should be fine.

  MohammadHosein     August 7, 2007 15:13.07 CDT
i wouldnt think of anything simpler than IAT hooking

P.S jms : is madshi's code hooking driver signed for Vista ?

  JLeCours   August 7, 2007 15:13.20 CDT
Heh.. for some reason I was thinking I needed to add an IAT reference for the api.  Since they are both in the same dll, I shouldn't have any issue simply jumping directly to it, eh?  I'll have to look closer at the function implementations, but I believe the signatures are close enough that I should be able whip something up. :\  Thanks for the slap.  Any further thoughts would be great too.

  jms     August 7, 2007 23:02.55 CDT
The Madshi lib isn't a driver, and he combines IAT patching with some other voodoo. And yes it works on Vista, and is straightforward to use, although it has to be written in C/C++ as you are actually creating a DLL. Although you can use my python library for the injection/ejection if you want to :)

  MohammadHosein     August 8, 2007 00:49.52 CDT
i've been using its Delphi version for a long time , and CodeHook had some stuff on kernel too so i doubt we are talking about the same thing . the Mashi'c codeHook driver name was mchlnjdrv.sys and according to himself it was using for process execution hooking , shipped inside binary and extracted on the fly

  JLeCours   August 8, 2007 11:57.57 CDT
Since this is a single hook, I think using Madshi's madness would be overkill.  I think I could inline patch the IAT to a code cave, where I manipulate the stack so that I'm essentially just wrapping the desired function.  I'd have plenty of control and I think the implementation would be fairly straight forward.

  nico     August 8, 2007 16:49.36 CDT
can't you just change the strings of the function in your import table, and use the new function, then patch the code accordingly, depending of the parameters.

or just add a new IID in your import table, and patch the code.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit