Fix a bug happened when fixing IAT via ordinal#10
Merged
aaaddress1 merged 1 commit intoaaaddress1:masterfrom Mar 28, 2021
Merged
Fix a bug happened when fixing IAT via ordinal#10aaaddress1 merged 1 commit intoaaaddress1:masterfrom
aaaddress1 merged 1 commit intoaaaddress1:masterfrom
Conversation
Owner
|
感謝XD 您提的這個我有注意到, 不過最近寫書正忙所以一直擺著就忘記這件事了 hahah. |
Contributor
Author
没事，小忙而已～ |
Owner
|
預期書名會是 Windows APT Warfare《惡意程式前線戰術指南》約莫今年六月中會上實體通路 XD |
Contributor
Author
坐等拜读了 XD |
fengjixuchui
added a commit
to fengjixuchui/RunPE-In-Memory
that referenced
this pull request
Sep 7, 2021
Merge pull request aaaddress1#10 from ph4ntonn/master
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi～
在#5 中，虽然在一定程度上修复了基于ordinal来查找函数导出地址的bug
但是，逻辑并不是很严密，因为原pr认为只要第一个函数是基于ordinal导出，那么此dll中所有导出函数应当全基于ordinal
实际上，这种情况并不具有普适性(可以看附图)，并且根据IAT的加载方式，应当先查找orginThunk所指向的INT表来决定是基于name还是ordinal来导出函数至IAT表
所以这里对#5 中的patch进行了一些修改～
顺便感谢作者的项目，给了我一些工具上的思路～