Home/ Questions/Q 8316869
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-08T21:27:19+00:00

I have been messing around with the PE file structure in Assembly Language. I’m

  • 0

I have been messing around with the PE file structure in Assembly Language. I’m pretty sure I have gotten to the the Import Section correctly. I am using this as a reference where each box is equal to 4 bytes:

+-------------------------+-------------------------+
|     RVA to a list of    |       DATE/TIME         |
| pointer to APIs names   |                         |  IMPORT DATA DIRECTORY
+-------------------------+-------------------------+          #1
| .DLL address (unused)   |     RVA to .DLL name    |
+-------------------------+-------------------------+
|RVA to API address list  | 
+-------------------------+

Ollydbg. Notice the value of eax on the right side (00402048) which is the value I looked up in the import section and then look at the value of the highlighted instruction (00402000)

Ollydbg. Notice the value of eax on the right side (00402048) and then look at the value of the highlighted call instruction is jumping to(00402000).

I attempted to call the first first function from the (RVA to API address list) which is ExitProcess however when I tried issuing a call to the address, it caused my program to crash. When I debugged it with Ollydbg, I found out that the address when call ExitProcess was issued was different than the address I found in the list. In Ollydbg the address I found pointed to <&KERNEL32.ExitProcess> while the call ExitProcess pointed to < JMP.&KERNEL32.ExitProcess>. I have read somewhere about some kind of jmp stub. Is that what this is? How am I supposed to call the functions in the “RVA to API address list”?

I know this may be confusing. If you need more clarification let me know.

Here is the code:

extern printf
extern ExitProcess
global _start
section .code
 _start:
    mov eax, [imagebase]
    mov esi, eax
    add eax, 3ch
    mov eax, DWORD [eax]
    add eax, esi; PE header pointer in eax
    add eax, 128; 24 for PE Optional Header offset and then 104 for import RVA
    mov ebx, DWORD [eax]
    add ebx, DWORD [imagebase]; ebx now has import section offset
    mov eax, DWORD [ebx+16]
    add eax, DWORD [imagebase]; has array offset
    mov ecx, ExitProcess
    push 0
    call ecx
    ;call eax
    ;jmp ecx
    ;call ExitProcess

imagebase: db 0,0,64,0; 0x00400000; This is right
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It seems as though I had found array but I never retrieved the value at that address. So I was trying to call the function at the address of the array not the at the first element of the array. 

    extern printf
extern ExitProcess
global _start
section .code
_start:
    mov eax, [imagebase]
    mov esi, eax
    add eax, 3ch
    mov eax, DWORD [eax]
    add eax, esi; PE header pointer in eax
    add eax, 128; 24 for PE Optional Header offset and then 104 for import RVA
    mov ebx, DWORD [eax]
    add ebx, DWORD [imagebase]; ebx now has import section offset
    mov eax, DWORD [ebx+16]
    add eax, DWORD [imagebase]; has array offset
    mov eax, [eax];This is what I needed to do
    push 0
    call eax

imagebase: db 0,0,64,0;
    • 0