Conversation

Resolving API Hashes through exceptions. should make a reverse engineers life a bit harder. I share modular code which will make it easy to use in your own projects github.com/rad9800/VehApi TODO: inline this function, then mess the IDA disassembly up

252

namazso

@namazso

For one I don't see what this has anything to do with import resolution, you could replace any function like this. Second, you could simply use SEH and __debugbreak instead of the blatant AddVectoredExceptionHandler usage and easy-to-xref wrapper function.

9:23 PM · Aug 4, 2022

Bookmark

That's a valid point, it's not exclusive to import hashing but I found this is a suitable use for it. It'd be a lot better if the wrapper function was inlined. I used __debugbreak orig but switched.I didn't use SEH as I haven't been able to get it working standalone without crt.

namazso

@namazso

Aug 4, 2022

to get SEH working all you need to do is reimplement __C_specific_handler. Or use this MIT licensed copy:

github.com

reactos/ehandler.c at 0520c75aaf3a9334d209e6b5ec04f15cb9b773c4 · reactos/reactos

A free Windows-compatible Operating System. Contribute to reactos/reactos development by creating an account on GitHub.

Show replies