|
Over the years I have invested heavily in product R&D building a wide
assortment of new skills, and fostering a diverse background and understanding.
These are some of the papers I have developed along my journey that I make freely available to help others along. |
Sandsprite Papers
VB6 P-Code / Reversing
Reverse Engineering / Binary Analysis
Understanding the Import table
Understanding IAT Hooking
Understanding Peb Module Lists
Libemu Shim for Unicorn
Remote Symbol Resolution
Visual Basic 6
- Understanding how the Import table works - 2005
This paper will give you a graphic representation of the binary structure used for the PE import table and explains why this design mechanism was required.
A download package is also available which shows a very simple exe in packed and unpacked states. This package also includes a memory dump with broken imports to give you a simple trainer to try to restore to apply the knowledge gained in the paper.
A small beta quality open source utility is also available which lets you rewrite the import table of an exe as you desire.