Log in

View Full Version : how to determine importtype?


0rp
May 19th, 2004, 06:00
how can i determine the type of an imported symbol (function or var) ?

VirtualQuery returns always PAGE_EXECUTE_WRITECOPY

dELTA
May 19th, 2004, 06:53
You might want to be a little more specific than that, just a tip...

0rp
May 19th, 2004, 07:04
i get the addresses of all imported symbols of a module (through IMAGE_IMPORT_DESCRIPTOR and IMAGE_THUNK_DATA...) for hooking purposes (of course

i now modify these addresses, and let them point to custom code, but this will crash if the symboladdr points to a variable instead a function (i.e. msvcrt._acmdln)

or i'm completly wrong and these addresses will never point to variables?

doug
May 19th, 2004, 17:31
Given an import table, i don't think there is any way to tell whether a particular entry is an imported variable or an imported function.

How you import it and how you use it define that behavior.

With that said, what you want to do can probably be done in another way.. tell us what you want to do, we'll be able to help more.