So in this video, we will be parsing the exports from that area.
If you generate a data using the Metasploit, it won't have any exports.
So it's kind of like a XY, but a dealer.
So that's why I have taken the Sims V C runtime one to the other.
So we'll be parsing all of these export functions.
So if we go to option header in the data directory we have, the starting one is the export directory.
So it has the address and it has the size.
So if I click on this address, I will go to this array.
Now here we have these.
You can pass these into this export descriptor.
So the characteristics is zero and you can pass these as well timed each time.
And the important one is the name.
So.
So then we have the number of functions, number of names, number of orders of functions, address
of names and name address.
So these number of functions define the total number of functions that the dealer is exporting.
And the number of names is how many functions that are being exported via name.
So the function can also be exported by our name or without any, without having any name to it.
But in our case you can see both are sound and that means our functions are exported via our names and
here we have of functions.
So if you go to this, we have array of addresses where each belongs to the string.
So the function, address and address of names contains the array of addresses.
And if you go to the address, you will find the strings and address of name address.
So here we have index to this array.
So what we're going to do is let's first go to that list of names and you can see the first four bytes
d2507 so d2507 is this one.
So if I click on this one, I will be redirected to this function name.
And to find the address of this function.
What you need to do is you need to look at the name of Dennis.
The first parallel to this.
This is the first element.
And you need to look at the first element in the order of name orders.
That is zero.
So go to the zero index of this order of functions.
So a zero index of these functions.
If I go to this, I will have this area.
And if I go to the first element that is this four bytes, 07e798.
So 77 nine if I go and that will be the address.
So here we can see it looks like a function.
So this.
Is the functional dress and.
The similar way for the second element.
The second element is the one, 3 to 5.
rb2513.
Sorry.
So this is the.
This is the second function.
And if we go to the second element of this one, you will have this address.
So the address.
He's won for C, so one for C yet is the functionary.
So we are going to pass this information.
So first let's go to the optional header and get this data directory.
So we have already password all of these headers previously so we can say.
Anti header dot optional header dot export table dot, whatever address.
So this gives you the this one your address so we can say long export offset.
So we have this offset.
If you add it to the base address, you'll be taken to this one.
So what we can do is we can master this one hour shall dot pointer to structure.
And the first one is the pointer.
We need to point this one.
So Bill's address.
Not two in 64.
Press export offset.
So that gives you.
This one.
So we have this one.
But convert this to the pointer.
And we need to marshal as.
The Export Directory.
Image Export Directory.
Export is equals to.
So we have the we have some error here.
Okay.
We have the expert.
So.
Also this export offset should not be zero, so this export offset will be zero if in the case of EXS,
if export offset not is equal to zero, then only pass the image export directory.
Now.
The name is this one.
So.
What we can do is.
This address.
Press export dot name.
So if you combine the best address plus this one, you get the address pointing at this starting other
thing and then you can convert this interesting master pointer to string and see.
Now let's over this string data.
Now I'm going to print that name.
So we should get the distributor name.
So let's run this.
I'm sorry.
Let's run this and we can see the exported uranium.
Now we can go and pass these functions.
So the first normally printout are the functions function names.
We can also print.
A number of functions.
Export a number of functions not to string.
A number of names.
So it's going to run this and we can see some red face on it.
So in hexadecimal now let's go and print all of these names.
So at risk of names, if you go to this, I will have array of addresses and I need to master these
the content that this address to the screen.
So I export that address off names.
So if I add base address.
So this one aggregate exact address.
Exact address at this first function so I can loop over this number of functions for int equals to zero
less then export dot.
Number of functions.
I.
Press.
So I'm.
I'm going to report this.
So this is a pointer.
So.
So Mark shared our pointer to String and C and specify this pointer.
String function name.
Now let's go and print this.
So we are not incrementing.
Now we are just printing out the function name.
For now, let's run this.
Okay.
We need to read that for veterans or not at this, uh.
So let's cut this one.
We need to read the contents at this.
So, Marshall, not read into the tea to.
Now I am reading that address.
Now I get the value.
These the 2507.
So that will be stored in.
It's a function of set.
I can see a function of offset if I want to run this.
So I think I found that what we are doing, we are not adding the base address to this function offset.
So sorry for that.
Actually, we are reading the only the function offset.
I forgot to add this base address to this one.
Now, if we can run this and we can see the function name, now I can look through this export x number
of functions.
Each time I'm looping, I need to add four points.
Because I need to read all through these four bites at a time.
So how I can do is I can say, plus I.
In the Four Seasons.
It starts with zero and ends with number of functions minus one.
We can say two four.
So at the first iteration, it takes a zero and second iteration for eight, etc..
So I won't run this.
So it's, uh, condition based here.
Okay.
We should cut this and paste here.
So sorry for this.
Let's run this.
And here we can see all of the functions.
So why?
Because we need to increment at this function.
Offset.
So we are moving the function offset by four.
So I think we are good to go.
The function now, what we're going to do is we are going to resolve these name, address.
So let's say an index ordinal is equal to Marshall not reading the 32.
Pinter.
And this address.
Press export dot.
Are Drosophila models, so they should.
Give you the offset to the first ordinal.
We can also add AI into to.
So to get every index so it is only two bytes 00010203, so on.
So we have the index.
Now we want to loop through these other functions.
So similarly, you can copy out of this.
And based here.
So instead of at this of name address, we can specify that are functions and we want to loop over four
bytes at a time.
We are going to get int function address offset.
Can call this as function name offset.
So for this function there is an ordinance zero and we need to go to this area at the zero index.
That is the first element.
So for this function.
For this output of function, the index will be zero and we need to
use this as an index to this function.
So what we can do is we can say instead of a index ordinal.
So we are accessing the index ordinance element in this area.
So we had a function address offset so we can.
Go and.
We can go and print this function, address ourselves so we can say function name.
And the index ordinal.
And that dress.
Nobody.
So the function name is the first and the index.
Ordinal and the function.
Address Sunset Canada crushing.
So I think we are good to go now.
So let's go and print this.
We got an error.
Okay.
Sorry again.
So this is also the area.
So if you go to this one, you will have this.
Any of these artists.
And you need to read again.
So.
Martial Arts Reading 32.
So we are going to read again.
So the function at the outset gives you the gives you it here.
So here we need to read four bytes at a time.
So we can say best address.
Press function address offset.
Plus now we can say index order into four.
Function address.
So I think we are good to go.
So let's run this.
Well.
I to.
So now we can see we got the function name and the index order and the address.
I think we got somewhat wrong, I guess.
We are adding it to the best address.
So that's why we are getting more values.
So to comment on this one.
Now let's run this.
And now we can see we got this.
Address.
7e798.
709.
That is the function outset 143814.
See here.
And see four.
So we got the same function also.
So according to the index, we got some wrong.
So the terms of fixed that index are there.
So we are doing something around this index or not.
So if you go to the base address, press this offset, you will have this one.
His address in this one.
You don't need to do like this.
We can read into 16 so we can directly read two whites at this address.
So if you run this or.
We are printing only the one element, so we need to add AI into too as well.
So let's run this and we can see now the index orders are correct.
So grow one, two, etc. so we can insert off the eye.
We can do index or dinner.
So the printing the correct assets for these functions.
So we can see we got successfully passed.
The exporter functions in a deal.