2

First of - Hello and thank you for reading this,

I have one DLL which I do not have the source code but need to add some functionalities into it.

I made up another DLL implementing all these needed functionalities in C - using Visual Studio.

Now I need to insert the generated code from this new DLL into the target DLL (it has to be done at the file level {not at runtime}).

I am probably creating a new PE section on the target DLL and put there all the code/data/rdata from the dll I made up. The problem is that I need somehow to fix the IAT and the relocs relative to this new inserted code on the target DLL.

My question is:

What is the best way to do it?

It would be nice if Visual Studio came up with an option to build using only (mostly) relative addressing - This would save me a lot when dealing with the relocs. I guess I could encapsulate all my vars and constants into a struct, hopefully MSVC would then only need to relocate the address of this "container" struct and use relative addressing to access its members. But don't know if this is a good idea.

I could even go further and get rid of the IAT by making a function pointer which would dynamically load the needed function module (kind of the Delay Load Module). And again, put this function pointer inside the "container" struct I said before.

The last option I have is to make it all by hand, manually editing the binary in hex... which I really didn`t want to do, because it would take some good time to do it for every single IAT entry and reloc entry. I have already written a PE file encryptor some time ago so I know most of the inner workings and know it can be done, just want to know your thoughts and maybe a tool already exists to help me out?

Any suggestions is highly appreciated!

Thanks again for your time for reading this!

user1036015
  • 31
  • 1
  • 3

1 Answers1

0

Since you are asking for suggestions, take a look at the very good PORTABLE EXECUTABLE FILE FORMAT – A REVERSE ENGINEER VIEW PDF Document. The Section "Adding Code to a PE File" describes some techniques (and presents Tools) to add code to an existing PE image without having the code of the target image (your scenario) by manipulation the IAT table and Sections tables.

mox
  • 6,084
  • 2
  • 23
  • 35
  • Thank you for replying. That helped a lot about the IAT, but still didn't find a good way to deal with the relocs, guess I am going to have to write a small tool to automate the fix! – user1036015 Jun 13 '12 at 16:27