1
0
Fork 0

DBG: correctly enumerate imports as IAT addresses

This commit is contained in:
mrexodia 2017-02-18 20:35:20 +01:00
parent e760af25b2
commit e83524461c
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
3 changed files with 7 additions and 4 deletions

View File

@ -9,9 +9,9 @@ namespace Script
{
enum SymbolType
{
Function,
Import,
Export
Function, //user-defined function
Import, //IAT entry
Export //export
};
struct SymbolInfo

View File

@ -143,7 +143,7 @@ bool apienumimports(duint base, const IMPORTENUMCALLBACK & cbEnum)
return false;
// Callback
cbEnum(base, imageFtThunkData.u1.Function, importName(), importModuleName);
cbEnum(base, (duint)imageIATVa, importName(), importModuleName);
// Move to next address in the INT
imageINTVa++;

View File

@ -46,6 +46,9 @@ BOOL CALLBACK EnumSymbols(PSYMBOL_INFO SymInfo, ULONG SymbolSize, PVOID UserCont
else if(!strcmp(curSymbol.decoratedSymbol, curSymbol.undecoratedSymbol))
curSymbol.undecoratedSymbol = nullptr;
// Mark IAT entries as Imports
curSymbol.isImported = strncmp(curSymbol.decoratedSymbol, "__imp_", 6) == 0;
cbData->cbSymbolEnum(&curSymbol, cbData->user);
return TRUE;
}