Hello,
I've another question related to my previous post [Win32 Hooks... 13/07].
If I'm not wrong, Import Address Table of an image in memory contains only
the addresses of implicitly imported shared libraries.
Indeed, scanning the IAT of programs like IEExplorer returns only basic
dlls: networking dll (WS2_32.dll, etc) are explicitly loaded when required.
When implementing an API hooking system, is there the possibility to use a
'IAT patching' - like technique on a process that explicitly loads shared
libraries using LoadLibrary( ) function ?
In other words, is there an area of image file where process records the
'dllname'-'dlladdress' couples ALSO for the explicitly imported dlls
(something like the [...].OptionalHeader.DataDirectory
[IMAGE_DIRECTORY_ENTRY_IMPORT] section) ?
Sorry for bad English.
Thank you,
Federico Blaseotto
