EATs in PE

In Chapter 3, Dynamic API Calling – Thread, Process, and Environment Information, we successfully explored dynamic memory to get to the image base of the desired system module. These loaded PE modules are also loaded into dynamic memory through file mapping. Once we get the address of a DLL, then we can use the API’s GetProcAddress to get the address of the specific function it exports.

So, here a new question comes to mind: is there any difference in the binary structure between PE programs with export functions (DLL) and PE programs without export functions?

Figure 4.1 is dllToTest.c, an example of streamlined DLL module source code under the Chapter#4 folder of the GitHub project:

Figure 4.1 – Sample of simple DLL code

On line 16 of the code is a standard DLL entry function. When this DLL module is first mounted to the process, the global string variable, sz_Message, is modified to Hello Hackers!.

Back to lines...