So in this video, we'll be talking about the impulse, only the theory part.
So we have already seen here the import directory and this address points to the first impulse.
So generally, whenever your application needs something, of course your application do something by
default it will load some errors and they will be functions in those details which this application
uses or in my case, car two dot X to perform some operations.
So there are some core operations that are core operational functions that are in the cabinet that you
got here and some other details and all those functions.
Addresses need to be imported into this structure so that the application can access that function and
runs that code.
So by default, our linker can write these addresses, but.
It's going to be dynamic.
So whenever there is there are any updates to the operating system, these are the changes.
So that's why we need to update these the functions of these addresses of these functions whenever we
are reloading this executable file.
So here we have the import directory and this address points to the first import image sorry, image
import descriptor.
So the contents of this image import descriptor are as follows.
So characteristics are a general first thing in RA in the disk, the characteristics and in the memory.
It's called general.
First, thank.
Next one is Time Stamp and Forever the chain name.
So this is the structure of image import descriptor and the origin of first tongue.
And the first tongue are almost similar.
So this origin of first tongue points to the address of an array of this data structure, image data.
So first let me cover this timestamp for our chain and the name.
So this name contains the name.
So this name contains the actual name.
And this first thing points to this array of these structures.
And these structures we have the address of the function.
So the function, actual name here we have the DNA name and here we have the function name.
So if the if we are importing like 20 functions from this drill and we have this 20 number of image
data structures, so there is no ending for this.
The ending of this image input descriptor structures would be identified by zeros.
So null image, import descriptor.
So a structure with all the fields zero.
So that means if you came to this G or zeros in these fields, that means are the inputs have been completed.
So let's see this diagram here.
You can see this first block is the one and the second block binds to another name and the function
name and the third point to the third.
So here you can see the imported data name points to the candidate and second one points to user 32
and third one to points to at once.
We pay the third here.
So let's see that in the pivot.
So you can see the total size of this image.
Import descriptor is 20 bytes.
So you can see the.
Okay.
These are the 16 bytes.
And up to this three column, we have 20 bytes.
The name is last but one.
So this one will be the name.
000041588 RB.
So here you can also you can see this everything is password.
Now, if I go and click this out of here for 158.
And I should go to the name of this better candidate so you can go to this address and read the string
from this.
Get this.
Candidate.
Dealer.
All right.
Now you can report these structures.
So this, uh, first read first 620 bytes from this address pointed by optional header dot import directory.
So this at this point is the first descriptor image import descriptor, read 16 bytes from these server
20 bytes and calculate get the string and read next to 20 bytes.
And here you can see the next 20 bytes are zero.
That means there is only we are importing only functions from one dealer that is only Canada dealer.
So you can identify the next 20 bytes are completely zero.
That means there are no more imports.
And after calibrating all the inputs, you can print them to the Screen Canada data.
Now we need to parse the function names.
You can see the original first time.
So before loading the original first tongue and the first tongue contains the same data so the same
of this image tongue data structures.
But whenever we need to fix these function addresses this.
The.
I trust pointing to this first time should be replaced by the data of the function addresses.
So let's see what this original first tank points to.
So Jennifer Stang is the first member and that is 4140.
And here you can see the we were already past this forum for zero.
If I click on this, I will get the starting off.
All of these image data structures.
So let's go and click on this.
And here we can see we got the.
This for one, six, six.
And if I go to four and six, six.
That is the address of the.
My name.
Name of the function.
So you can click on four one, six, six.
You can also click on this because it's been parsed.
And you can see the first one is the hint.
So this first two bytes is the hint.
And the second the name is of dynamic size because we don't know how much length each function.
So each function length is not constant.
So.
We read up to another.
Bladder function.
So this is the what's the function?
Now you can come back and come back to the first tank and again, go to this.
And the next you can see the two debates and then exit process.
So.
So you can also click here 4176.
So 4176.
So these are not in words.
This is a hint.
And the next after two bytes is the string.
So an alternative string, we can drill up to this and find the function name.
So we found the function name exit process.
And we also found another function that is virtual.
So you can see these are like a continuous,
continuous manner until you reach zero.
You need to read these functions.
So after reading the function you need to use, we are going to use the load library to log the data
and get proc address for this function name and we need to get the address and all write in this first
time.
So you can see the first one is pointer to this data here.
You can see and if you click on this original first time, it will also be pointed to same data.
So but there are some bytes.
So you can click on this.
This data should be replaced by the addresses of the function.
So I have pass, we have passed these function names and the other name.
So after that we are going to use load library to roll this viral and get properties to get that to
serve the function.
After getting that for each function address for the first one, we need to write this first.
So we are doing the if we are doing 64 bit V two or over this eight bites.
So that's how you need to operate.
Write the function addresses into this first tank pointer.
So.
That's all about the inputs.
We can also see.
Another image you can see.
Well, you know, FIRSTBANK points to the, uh, this area.
And the first thing also points to this same error.
But after Van loaded into memory, we need to write the addresses of the function to this error.
After that, we can continue execution.
So let's see another example you can see optional header for her DXY.
If you go to this 8000, this is the starting of the first image import descriptor structure.
If you go to fetch 20 bytes, that is up to these three.
First one is original 478078.
So a078.
So 078 So if you click on this, you will be taken to this tank data structure and at this address you
have a two for it.
So if you go to this, a two for it, you will have the import by name structure.
That is the hint and the function name.
In case you can.
From this point onwards, you can try to loop until you get the of it.
So you can see there are a lot of functions.
So you can just simply loop over until you reach the null weights.
So after finding that, you can update the values or the functional addresses in this first term.
So the terms the tree about this imports.
So don't worry after we'll be parsing the P file and then writing the content, you will get much more
clear understanding.