View Single Post
  #5  
Old 08-20-2019, 08:16
chants chants is offline
VIP
 
Join Date: Jul 2016
Posts: 725
Rept. Given: 35
Rept. Rcvd 48 Times in 30 Posts
Thanks Given: 666
Thanks Rcvd at 1,053 Times in 478 Posts
chants Reputation: 48
Yes I had thought the relocations would need to be fixed as well. I was not sure if there was a novel way to change the name addresses without doing so. Anyway the PE file format is reasonably well documented so I think fixing imports and relocations is still not overly difficult.

But I would challenge to try DUMPBIN /EXPORTS on kernel32.lib and see if the order is in the same order the executable table is compiled with. It might not be but it would seem likely otherwise the linker has some strange ordering algorithm - if it enumerates a hash table for example it would seemingly have no rational logic behind the order. Certainly doubtful a setting exists for this as it is a detail that is supposed to be encapsulated in file format internals. As for the order of the libs themselves, I think that would be determined by the order specified in the project settings presumably. Again hash table enumeration is always possible. All of these details are up to the linker type of things.

Maybe could remake a .lib file to reorder the exports, but doubtful that it is worth the effort and as alluded might not even work.
Reply With Quote
The Following User Says Thank You to chants For This Useful Post:
Newbie_Cracker (08-25-2019)