Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #18  
Old 03-01-2011, 15:12
V0ldemAr
 
Posts: n/a
Some tips:

1) Don't forget about forwarded exports ( they point inside of export table )
2) There may be more than one function with same RVA
Examples:
SetHandleCount = LockResource
NtOpenFile = ZwOpenFile
3) Optimization, need to build lookup tables with name of functions and need to sort table with RVA then simply apply binary search by rva but be aware if you sort rva's standard CRT binary search won't return you pointer to the first function( in other words if you have 3 functions with same rva bsearch may return to you any 1 of 3) so you will need to find first and last by going backward and forward increasing pointer in table.

Good luck.
Reply With Quote
The Following 2 Users Gave Reputation+1 to For This Useful Post:
ahmadmansoor (03-01-2011), dila (03-02-2011)
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
fake mac address theGate General Discussion 16 08-13-2022 10:12
Get real address of api not nt version Mahmoudnia General Discussion 18 05-23-2018 00:44
Finding API Address britedream General Discussion 5 10-05-2006 21:28
how to get the address of the entry point in an API Warren General Discussion 6 08-30-2005 16:18


All times are GMT +8. The time now is 13:11.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )