diff --git a/pe/superpe.py b/pe/superpe.py index 226ca0e..758d7f8 100644 --- a/pe/superpe.py +++ b/pe/superpe.py @@ -40,7 +40,12 @@ class SuperPe(): for section in self.pe.sections: self.pe_sections.append(PeSection(section)) + self.iat_entries: Dict[str, IatEntry] = {} + self.init_iat_entries() + + def init_iat_entries(self): self.pe.parse_data_directories() + self.make_iat_entries() ## PE Properties @@ -330,6 +335,9 @@ class SuperPe(): def get_iat_entries(self) -> Dict[str, IatEntry]: + return self.iat_entries + + def make_iat_entries(self) -> Dict[str, IatEntry]: iat = {} for entry in self.pe.DIRECTORY_ENTRY_IMPORT: for imp in entry.imports: @@ -342,7 +350,7 @@ class SuperPe(): if not dll_name in iat: iat[dll_name] = [] iat[dll_name].append(IatEntry(dll_name, imp_name, imp_addr)) - return iat + self.iat_entries = iat def get_replacement_iat_for(self, dll_name: str, func_name: str) -> str: diff --git a/phases/injector.py b/phases/injector.py index dc83d83..7f49346 100644 --- a/phases/injector.py +++ b/phases/injector.py @@ -53,8 +53,10 @@ def inject_exe(main_shc: bytes, settings: Settings, carrier: Carrier): )) # do the patch superpe.patch_iat_entry("KERNEL32.dll", iat_name, iatRequest.name) + # we modify the IAT raw, so reparsing is required superpe.pe.parse_data_directories() + superpe.init_iat_entries() shellcode_offset: int = 0 # file offset