Jump to content
Posted 16 May 2012 - 02:00 AM
Posted 16 May 2012 - 02:20 AM
Posted 16 May 2012 - 02:42 AM
Edited by .3lite, 16 May 2012 - 03:08 AM.
Posted 16 May 2012 - 04:18 AM
when once you've added the function to the IAT, you can use olly to get its address (via ctrl + n, if you have the default shortcuts), then you call that address, which will look something like:
How to read functions and their address if they are in executable's IAT? If not, should LordPE allow me to add those functions to executable's IAT?
It's kind of cool working with Ollydbg and It would be essential to avoid such problems in the future
//Your code: CALL 12345 //IAT entry: 12345: JMP DWORD PTR DS:[<&KERNEL32.LoadLibraryA>]alternatively you can do a direct call via:
CALL DWORD PTR DS:[<&KERNEL32.LoadLibraryA>]
Posted 16 May 2012 - 04:09 PM
Edited by .3lite, 16 May 2012 - 09:34 PM.