OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Topic created on: November 17, 2007 23:12 CST by fuzzforfun .

OllyDbg Alt+M:

Import Table address = XXXX

Import Table size = XX

I want:

struct _IMAGE_DATA_DIRECTORY {

    DWORD VirtualAddress;

    DWORD Size;

}

pefile:
pefile.PE(filename.exe).DIRECTORY_ENTRY_IMPORT.???

:(

ero		November 18, 2007 04:07.43 CST
To get the size and RVA of the directory entries you can iterate through them with the list in the Optional Header: The following snippet will return a list of pairs (Size, RVA) for each of the directories: `[ (d.Size, hex(d.VirtualAddress)) for d in pe.OPTIONAL_HEADER.DATA_DIRECTORY ]` The imports directory is the one at index 1: `import_dir_rva = pe.OPTIONAL_HEADER.DATA_DIRECTORY[1].VirtualAddress import_dir_size = pe.OPTIONAL_HEADER.DATA_DIRECTORY[1].Size import_dir_address = import_dir_rva + pe.OPTIONAL_HEADER.ImageBase` To iterate thought the actual imports: `for entry in pe.DIRECTORY_ENTRY_IMPORT: print entry.dll for imp in entry.imports: print '\t', hex(imp.address), imp.name`

fuzzforfun		November 18, 2007 10:05.48 CST
So much thanks! I had seen the other WORD/DWORD in pe.OPTIONAL_HEADER but lost how to address DATA_DIRECTORY! :)

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Imagery

SoySauce Blueprint
Jun 6, 2008