Results 1 to 4 of 4

Thread: how to determine importtype?

  1. #1

    how to determine importtype?

    how can i determine the type of an imported symbol (function or var) ?

    VirtualQuery returns always PAGE_EXECUTE_WRITECOPY

  2. #2
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,206
    Blog Entries
    5
    You might want to be a little more specific than that, just a tip...

  3. #3
    i get the addresses of all imported symbols of a module (through IMAGE_IMPORT_DESCRIPTOR and IMAGE_THUNK_DATA...) for hooking purposes (of course

    i now modify these addresses, and let them point to custom code, but this will crash if the symboladdr points to a variable instead a function (i.e. msvcrt._acmdln)

    or i'm completly wrong and these addresses will never point to variables?

  4. #4
    Given an import table, i don't think there is any way to tell whether a particular entry is an imported variable or an imported function.

    How you import it and how you use it define that behavior.

    With that said, what you want to do can probably be done in another way.. tell us what you want to do, we'll be able to help more.

Similar Threads

  1. determine call used?
    By nams in forum The Newbie Forum
    Replies: 0
    Last Post: January 1st, 2011, 21:32
  2. how to determine the end of gzipped image
    By dion in forum Linux RCE
    Replies: 2
    Last Post: December 28th, 2009, 08:26
  3. How does IDA determine MONOSPACED fonts?
    By Aimless in forum Off Topic
    Replies: 4
    Last Post: June 9th, 2009, 15:37
  4. How to determine what Specific API calls do
    By ShCiPwA in forum The Newbie Forum
    Replies: 4
    Last Post: April 2nd, 2005, 13:52
  5. How does Ollydbg determine if a file might be pack
    By 1bitshort in forum OllyDbg Support Forums
    Replies: 3
    Last Post: July 8th, 2004, 02:24

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •