Print Page - Finding the EAT of a PE

Title: Finding the EAT of a PE
Post by: brew on December 22, 2007, 09:22 PM

Well? How do I do it?
I know that one of the elements of the DataDirectory[16] array (the last member of the PE32OptHeader struct) contains an RVA to the exports section but i really have no idea what one. help please! If i can find the correct one, i can add the base address of the dll with the export table's RVA then get the address of the IMAGE_EXPORT_DIRECTORY struct... then i can get to the EAT.

Title: Re: Finding the EAT of a PE
Post by: Hdx on December 25, 2007, 11:32 AM

If i recall correctly, IMAGE_DIRECTORY_ENTRY_EXPORT is the 1st element of that array. so the *DataDirectory = Pefile.DataDirectory[0].VirtualAddress
*DataExportDir = DataDirectory.VirtualAddress
Then DataExportDir.AddressOfFunctions
Something like that. Can't think straight.
~Hdx

Title: Re: Finding the EAT of a PE
Post by: brew on December 27, 2007, 12:38 PM

Quote from: Hdx on December 25, 2007, 11:32 AM
If i recall correctly, IMAGE_DIRECTORY_ENTRY_EXPORT is the 1st element of that array. so the *DataDirectory = Pefile.DataDirectory[0].VirtualAddress
*DataExportDir = DataDirectory.VirtualAddress
Then DataExportDir.AddressOfFunctions
Something like that. Can't think straight.
~Hdx

Thanks, hdx.

Valhalla Legends Archive

Programming => General Programming => Topic started by: brew on December 22, 2007, 09:22 PM