среда, 9 сентября 2015 г.

iertutil.dll unnamed exports

Perl script to make such files (must be run after applying appropriate .pdb):
#!perl -w
use strict;
use warnings;
use IDA;

my $with_addr = 0;

my $exp_cnt = GetEntryPointQty();
my $dparm = GetLongPrm(INF_SHORT_DN);
my($fh, $name, $mang, $i, $ord, $addr);
if ( $exp_cnt )
{
  open($fh, '>', "exp") or die("Cannot open file exp, error $!\n");
  for ( $i = 0; $i < $exp_cnt; $i++ )
  {
    $ord = GetEntryOrdinal($i);
    $name = GetEntryName($ord);
    $addr = GetEntryPoint($ord);
    next if ( $addr == BADADDR );
    next if ( $name !~ /_\d+$/i );
    $mang = GetTrueNameEx(BADADDR, $addr);
    $name = Demangle($mang, $dparm);
    $name =~ s/\(.*\)//g;
    if ( $name ne '' )
    {
      if ( $with_addr )
      {
        printf($fh "%d %X %s ; %s\n", $ord, $addr, $name, $mang);
      } else {
        printf($fh "%d %s ; %s\n", $ord, $name, $mang);
      }
    } else {
      if ( $with_addr )
      {
        printf($fh "%d %X %s\n", $ord, $addr, $mang);
      } else {
        printf($fh "%d %s\n", $ord, $mang);
      }
    }
  }
  close $fh;
}

вторник, 8 сентября 2015 г.

urlmon unnamed exports

It seems that ordinal 470 (RegisterProtocolMonitor) used in networkinspection.dll
This info was ripped from ida pro with simple perl script