12 replies to this topic

[Tony]

Wassup guys, 

 

As you know a exe file does has Windows imports, such as user32.dll. But I got a file which also has some selfmade imports, so not from Windows system.

Is there a way to determine if a import is from Windows self or selfmade?

[ComeBack]

I mean Microsoft dll´s does have a version info in the rsrc section, that could be a way. Also all important win api´s are backuped in the system32\dllcache for me.

[Tony]

That has nothing to do with my question...

[karcrack]

"selfmade imports"? What does that mean? It imports a DLL which is not "user32", "kernel32", "ntdll"...?

 

To know if a DLL is from Windows itself you must check the signature. Also you need to check that the EXE doesn't have a DLL nearby because if it imports "user32" and there's a "user32.dll" in the same folder as the EXE that DLL will be loaded instead of the W$ one.

 

Hope that's what you're asking for.

[Tony]

@karcrack

This is indeed were I'm asking for

 

I mean with selfmade imports, imports made by Delphi, like in the screen below.

 

So I could check indeed the signature. Both files (the selfmade & W$), got the "PE"-signature. Also they got both the "MZ"-signature. But the selfmade has one char more -> "MZP".

 

 

[karcrack]

You can also check if the file has Microsoft ©opyright in the File information. A simpler way is to have a white-list of the most used Windows libraries.

[Tony]

I thought there might be a generic and a easier way, but it doesn't look like that, so then indeed i have to use a white-list i guess.

 

Thanks for your help karcrack 

[Hess]

Also , walk for dependencies , even selfmade imports must import native windows libraries. From screenshot , they are a bit confusive , but , at the end they must "touch" native stuff. It looks like msvbvm60.dll which has also some funky stuff , but at end also does the same as Delphi libs.

[Tony]

Hess, on 12 Dec 2013 - 12:01 PM, said:

even selfmade imports must import native windows libraries

 

Not true mate. Some functions could be emulated. The ShowMessage function of C++ builder is a good example of it

[dugidox]

What about open file in Olly, right click anywhere in disassemble window and choose Search for  -> All intermodular calls

[Tony]

@dugidox

It should be done programmatically

[Hess]

Ah , got the point , something like Fake API's which are generated by protectors like Arma , Asprotect , etc , and real ones are hidden , You wanna make new ImpREC ?

[Tony]

@Hess, youre wrong (again)