View Single Post
  #1  
Old 08-18-2019, 16:08
Newbie_Cracker's Avatar
Newbie_Cracker Newbie_Cracker is offline
VIP
 
Join Date: Jan 2005
Posts: 227
Rept. Given: 72
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 49
Thanks Rcvd at 25 Times in 18 Posts
Newbie_Cracker Reputation: 26
How to shuffle names in the PE import table?

Hi Guys.

As I tried, it does not matter how the order of functions and API calls is in my C/C++ source code. Microsoft Visual Studio Linker fills the import table in a specific way, which is not clear to me; but the order of API names is constant for my code. For instance, it does not matter I call ReadFile() before or after SetFilePointer(). In a compiled EXE file, SetFilePointer may come even before CreateFileA/W.

Is there any way to change this order, literally shuffle the order of names at each compile?

The hardest way is to rebuild the import table; but it needs searching and patching the code to point to new import table. I'm looking for a quick way.

Any idea?
__________________
In memory of UnREal RCE...

Last edited by Newbie_Cracker; 08-18-2019 at 16:19.
Reply With Quote