View Single Post
  #3  
Old 01-24-2005, 05:56
raygun
 
Posts: n/a
Some indidrect dll stuff is in rdata area

That can't be all. I know the dlls have their own import tables that reference other dlls functions etc. But yet in exe files compiled with vc++6.0 I see the
IAT at the start of rdata section, the import table (dll names and function names) at the end of the rdata section and between -- among all the tables of function pointers for functions called by the program --- what seems to be references to other dlls called by the dlls listed in the import table. Eg. reference to the c runtime library used by one of the dlls in the import table etc. etc.

Why I need to know this: for reenabling demo-disabled items like print, save, many demo programs use a common technique of thunks - the program calls a vbl (memory location) with call dword ptr at this location it gets an address in the rdata section. At this adress in the rdata area is the address of the routine needed. So another call dword ptr on this address in the rdata area gets the function called in the program. In other words - the rdata area array is the address of the actual function to call - that is an address back in the program .text area. But the problem is finding the boundaries of the array of thunks - (function pointers for the C people). And sorting out the indirect dll function stuff - which somehow seems to be in there as well.
Reply With Quote