Injective Code inside Import Table

Ashkbiz Danehkar

Rate me:

4.95/5 (119 votes)

29 Mar 2007GPL316 min read

239.2K

10.1K

285

An introduction to injection the code into Import Table of Portable Executable file format, which is called API redirection technique.

zimport.zip
- ZImport
  - CALC_test.EXE
  - ZImport.exe
  - ZImport.sln
  - ZImport.suo
  - ZImport
    - COPYRIGHT.TXT
    - DumpSeek.cpp
    - DumpSeek.h
    - DumpWin.cpp
    - DumpWin.h
    - Graphics
      - cursors
        
        Finder.cur
      - icons
        
        DockedFinder.ico
        
        FloatingFinder.ico
        
        Thumbs.db
        
        ZImport.ico
      - XPtheme
        
        ZImport.exe.manifest
    - Inject.cpp
    - Inject.h
    - loader.cpp
    - loader.h
    - main.cpp
    - main.h
    - ntundoc.h
    - resource.h
    - stdafx.cpp
    - stdafx.h
    - TrayIcon.cpp
    - TrayIcon.h
    - ZImport.rc
    - ZImport.vcproj
itview.zip
- itview
  - itview.exe
  - itview.sln
  - itview.suo
  - itview
    - about.cpp
    - about.h
    - COPYRIGHT.TXT
    - dataview1.cpp
    - dataview1.h
    - dataview2.cpp
    - dataview2.h
    - Graphics
      - cursors
      - icons
        
        itview.ico
        
        Thumbs.db
      - XPtheme
        
        itview.exe.manifest
    - itlib.cpp
    - itlib.h
    - itview.rc
    - itview.vcproj
    - main.cpp
    - main.h
    - peliberr.cpp
    - peliberr.h
    - resource.h
    - stdafx.cpp
    - stdafx.h
pemaker7.zip
- pemaker7
  - CALC_test.EXE
  - pemaker.exe
  - pemaker.sln
  - pemaker.suo
  - pemaker
    - about.cpp
    - about.h
    - COPYRIGHT.TXT
    - Graphics
      - cursors
      - icons
        
        PEicon.ico
        
        Thumbs.db
      - XPtheme
        
        pemaker.exe.manifest
    - itmaker.cpp
    - itmaker.h
    - loader.cpp
    - loader.h
    - main.cpp
    - main.h
    - pecrypt.cpp
    - pecrypt.h
    - pelib.cpp
    - pelib.h
    - peliberr.cpp
    - peliberr.h
    - pemaker.rc
    - pemaker.vcproj
    - resource.h
    - stdafx.cpp
    - stdafx.h
pemaker6.zip
- pemaker6
  - pemaker.exe
  - pemaker.sln
  - pemaker.suo
  - pemaker
    - about.cpp
    - about.h
    - COPYRIGHT.TXT
    - Graphics
      - cursors
      - icons
        
        PEicon.ico
        
        Thumbs.db
      - XPtheme
        
        pemaker.exe.manifest
    - itmaker.cpp
    - itmaker.h
    - loader.cpp
    - loader.h
    - main.cpp
    - main.h
    - pecrypt.cpp
    - pecrypt.h
    - pelib.cpp
    - pelib.h
    - peliberr.cpp
    - peliberr.h
    - pemaker.rc
    - pemaker.vcproj
    - resource.h
    - stdafx.cpp
    - stdafx.h

// stdafx.cpp : source file that includes just the standard includes
// CryptAPI.pch will be the pre-compiled header
// stdafx.obj will contain the pre-compiled type information

#include "stdafx.h"

// TODO: reference any additional headers you need in STDAFX.H
// and not in this file

By viewing downloads associated with this article you agree to the Terms of Service and the article's licence.

If a file you wish to view isn't highlighted, and is a text file (not binary), please let us know and we'll add colourisation support for it.

License

This article, along with any associated source code and files, is licensed under The GNU General Public License (GPLv3)

Written By

Ashkbiz Danehkar

Germany

Ashkbiz Danehkar studied electrical engineering and computational science at the University of Rostock, Germany, where he obtained a Master of Science in Computational Engineering in the special field of Electrical Engineering in 2007. He worked as a software and hardware developer for some private limited companies until 2005, mostly focusing on industrial automation and microcontroller programming. During 2005–2006, he worked part-time remotely as a software reverse engineer for Panda Security (Bilbao, Spain). His master's thesis in 2007 was about the development of a microcontroller-based measurement system using an embedded system equipped with a real-time operating system (RTOS) and an AVR microcontroller to monitor the neuromuscular blockade and control the anesthesia.

Injective Code inside Import Table

License

Comments and Discussions