Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not include calls to own exports in the Import Table reconstruction #91

Closed
hasherezade opened this issue Sep 4, 2021 · 1 comment

Comments

@hasherezade
Copy link
Owner

hasherezade commented Sep 4, 2021

During the full Import Table reconstruction (/imp 3), PE-sieve collects all addresses of exports that are being filled in the module, and constructs the table out of them.

However, executables may call their own exported functions. It leads to an undesirable situation when PE's own exports are included in the new import table. Example below:

imports_from_self

Such functions should be filtered out and not included in the generated table.

fengjixuchui added a commit to fengjixuchui/pe-sieve that referenced this issue Sep 4, 2021
Merge branch 'imp_rec_refact' (Issue hasherezade#91)
@hasherezade
Copy link
Owner Author

Result: the recreated Import Table no longer contains own exports of the dumped PE:
imp_filtered

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant