So in this video, we will be fixing the inputs for the executable.
So every executable uses the functions in the ideas and those functions addresses should be updated
in the first one.
In the previous video, I forgot to say that this original first table is also called import name table
or import lookup table simply called int and the table pointer by this first tank is of course array
of tank data, but the data should be replaced by the artists of the functions that are loaded in the
memory.
And this is called import at this table, simply called IAT.
So this one is empty and this one is called IAT.
We now need to update this one.
We need to update this one.
So let's go ahead and do that.
If you go to optional header, go to this import directory and you can read the size.
If the size is greater than zero, that means there are some imports.
Go to this offset and you will see this one.
That is exactly this one.
This.
Here you can see click on this name and you can see these are 20 bytes of image import descriptor.
First we'll be resolving the names of all the details that should be used by the executable.
In our case, we have only one dealer that this executable is using.
You can see the next 20 bytes are zero.
So that means we need to loop over this.
From starting first import descriptor until we reach the number bytes na bytes of our 20 NA waits are
considered as the end of this are the input descriptors.
So this address plus and the header dot optional header dot import table.
So this import table
or dot Watson address gives you the.
The starting of this one.
So what we can say is this is the first pointer to the.
Pinter forced to import Pinter.
So let's say this one, and we need to master this.
So now the first time four pointer points to this address and the value is this one.
So we need to master this one master point to structure.
First import pointer and the type of how to each structure we need to match them.
So it's, uh.
Oh, you bought.
So let's create a new object of this structure.
Let's say this as first to import.
Now, what I can do is.
I can.
First you put that name to Sting.
So this will print the address.
That is the offset of this their name.
I have already removed this discrete thread.
So.
So let's go and run this one.
I think.
So let's run this and we will get the value 4158 so the 4158 is this one.
So 00004158.
So if you go to this 4158.
You will get the actual name of the beer.
You can see Canada Dealer.
So we don't know the exact size of the name.
So it just ends with the na na na by.
So what we can do is we can martial to the string.
So martial art pointer to string and.
So this will read up to the bikes, up to the orbit, and it will convert to the string.
So this name is offset.
So we need to add the base address.
But as to import that name.
So this is the address and it will master the string so you can string.
The name is equal to this one.
Now I can go and say print their name.
So we can actually remove this one.
And here you can see that your is Senator Dodd.
And in this cartoon that you see which is generated by Mr. himself has only one import dealer and in
the normal C windows notepad de thc we have multiple dealers.
So what we're going to do is we are going to print out of them.
So I have already had the part for this notepad, the text.
So all I can do is I can.
I need to loop over until.
This first important name not is equal to zero.
So we can do that using wide loop while first import name is equal, not as close to zero.
And then print this.
So we are printing that uranium.
We need to move forward.
So how are you going to move forward?
Is using these 20 bytes.
So these 20 bytes you can see you need to just to move forward the size of image input descriptor to
get the next to image input descriptor.
So if I move forward from this place to the 20 bytes, I will get to this place that is this font.
Now I can just simply read this address and master as a string.
So the fascinating part, Peter, this is pointing to the first import.
So what I want to do is I need to add the value of the size of this image import descriptor.
Now we are moving forward to the next image import descriptor.
That is this one user that we are.
Now we need to marshal the this from this position to this emerging descriptor.
So we are updating the first import as the this next import.
Now this will read again the name value.
This time the name will be this one.
The last penultimate diver.
So it is 299 to see, I guess.
So just let's go.
And it's good this.
And here we can see we got the all the other names.
We can also put the breakpoint and check for each and every step where this pointer is pointing.
But it's obviously clear now we are just moving 2020 bytes and reading up to there is another byte.
So we got the function names.
The other names we need to get the function names.
If you remember the our general first tank these this one first four bytes is pointed to the structure
image tank data.
And this is normally eight bytes.
So our first tank is zero to.
898 So here is see here it seems to eight nine here.
So it's the same value.
And if you go to this one, you would actually go to the this array of image data structures.
And if you take the first three eight bytes, this is pointing to the address that is pointed by the
import by name.
So there is a import by name which contains two members.
So here you can see import by name has two values.
So let's go to this address.
So it's 2938.
2938e.
So if you go to this and here we can see the hint that is two bytes and the name is we don't know the
length of the name because the function names are not fixed and the first two bytes are the hint and
the next one is the function name.
So we can also import the functions using ordinary, but we'll be seeing that in the future.
Videos.
For now, let's just focus on this function.
So we need to retrieve the value at this address.
So what we're going to do is we are going to get that for general first.
Thank.
So here we have printed that name, so let's make some space.
So, base address, press.
And T dot option dot.
Portable dot sensory.
First import important original first.
So this gives me to the position at this position.
Let me call this as first or general a pointer.
Now we need to master this one as.
It's.
First tongue pointer and we need to master this one as the data 64.
So let me call this one as first two or tango.
So now the fish tank has this value.
That is 293 80.
Now, if I go and add this one to the base address, I'll get to this.
This one.
So we can say pointer name pointer is equal to first two dot function.
Now we got the name Pinter at this starting one.
We need to skip two bytes to get the string because the official two words are the hint so we can see
string function names equals to match the pointer to string and C and the name pointer plus two.
Now we can go and function.
Is the function.
Now.
And we need to loop over until the.
This one is 010 first time.
So while our general satisfaction or general standard function not is equal to zero.
And we are going to move forward.
But first point or press is equals to.
The size of this image tank data or we can just say eight bytes.
My success is off.
A.
Image Data 64.
Now we have moved forward to this one.
Now we need to master this one or this one.
So we are moving forward and we are again marshalling this second aid bytes as this original first time.
I think we are good to go.
So let's go and run this and.
So here we can see we got all the functions for the every day.
So we can see that.
And we have the same exact functions.
So last one is get device cap.
So here we can see all the function names.
We can also change this to our original characteristics that was generated by Metasploit.
And here we have two functions which are dialogue and exit process.
So let's run this.
And here we can see that he has a name.
And the two.
The functions.
Two functions.
Now what we're going to do is we are going to load this data later into the memory so we can do that
using load, library or dealer name.
So this will give you a handle.
Handle to the module.
So lets in the pointer below handle.
And after getting this Twitter handle.
And we need to use the get proc address for the function.
So here we have the function name.
So get proc address, the dealer handle and the function name.
Now we will get the address of this function in the memory.
Pointer function address.
Now where we want to update is at this first one.
So if you go to the first one, you will have the first eight bytes and we need to update that value.
So.
Let me.
So we have this origin first tank.
So?
So.
First import.
Firstly important for first to thank.
So we have this one based address press.
The first tank gives you the offset for this.
So we can see first point.
So remember the first two pointer is different from this strong pointer.
So that's why I have put this general in this, uh, first to this variable name.
So we have this pointer.
And what we need to do is.
We need to update here.
Exactly.
Get dressed after getting the functional dress.
My shared copy.
So the functional dress.
Uh.
Function address dot.
64.
So this should give you the buy it off the dress.
It's called this sense funk bait.
Starting next year.
The destination is this one.
Fresh pointer.
And by that's rent.
So we are copying that function address into this first tank pointer.
And after copying we need to update this first tank pointer press is equal to eight.
So I think we are good to go.
So we have updated everything.
It's also put into the function address.
And after that.
That's the break point for this master copy.
We need to print out these dresses.
First to thank.
So this is the first tank.
So let's put the breakpoint and run this.
So the best address is this one.
The first tank is located at this.
So we have some values here that is exactly equal to the original fish tank.
Function address.
So that's if I go and step into this, this functions address value should be copied here.
So let's run this and here we should see 7fff00 so we can see the values here.
So we have successfully updated these.
But not so fast.
So if I continue this, I will hit at the same breakpoint master copy because of the wide loop.
So if I run this, if I step into this, we should see the zero here.
So the zero.
So I think we are good to go.
Now, since we have fixed the inputs, we can directly go and run this executable because the base relocations
are zero.
So we'll be also fixing the base locations in our next video.
Since for our executable, it's zero, we can directly go ahead and test this one using this create
thread.
So I'm going to run the thread at this entry point.
If we are if everything is good, we should see greater pop up and we can see the pop up.
So let's go and continue this one.
So that's all about this, uh, fixing imports and then actually we'll see about fixing base relocations.
Also, it's a good thing to write this entire code in a separate function like injector function.
So give it a function name and it takes the parameters like Rafael.
And the base is so base that there's no need.
So it takes the file and it's going to inject into itself.
So we also see those.
We write one function and we copy and turn code into that.
So that's how for this video fixing import address.