Rewrite GlobalAPIHandler (Global.Engine.Importer)

[Duncan]

as the title says, the function returns 0

[--]

questionable if working, all proxy to EngineGlobalAPIHandler which is buggy

GetDLLName -> EngineGlobalAPIHandler
GetAPIName -> EngineGlobalAPIHandler
GetAPINameEx -> EngineGlobalAPIHandler
GetAPIOrdinalNumber -> EngineGlobalAPIHandler
GetRemoteAPIAddress -> EngineGlobalAPIHandler
GetLocalAPIAddress-> EngineGlobalAPIHandler
GetDLLNameFromDebuggee-> EngineGlobalAPIHandler
GetAPIOrdinalNumberFromDebuggee -> EngineGlobalAPIHandler
GetRemoteDLLBase -> EngineGlobalAPIHandler
IsForwardedAPI -> EngineGlobalAPIHandler
GetForwardedAPIName- > EngineGlobalAPIHandler
GetForwardedAPIOrdinalNumber -> EngineGlobalAPIHandler
GetForwardedDLLName -> EngineGlobalAPIHandler
GetNearestAPIAddress -> EngineGlobalAPIHandler
GetNearestAPIName -> EngineGlobalAPIHandler

[Duncan]

This is the current state:

ImporterGetDLLName -> ImporterGetDLLNameFromDebugee
ImporterGetAPIName -> ImporterGetAPINameFromDebugee
ImporterGetAPINameEx -> remove?
ImporterGetAPIOrdinalNumber -> ImporterGetAPIOrdinalNumberFromDebugee
ImporterGetRemoteAPIAddress -> EngineGetAddressRemote
ImporterGetLocalAPIAddress -> EngineGetAddressLocal
ImporterGetDLLNameFromDebugee -> EngineGetModuleBaseRemote
ImporterGetRemoteDLLBase -> EngineGetAddressRemote
ImporterIsForwardedAPI -> remove?
GetForwardedAPIOrdinalNumber -> remove?
GetNearestAPIAddress  -> EngineGlobalAPIHandler
GetNearestAPIName -> EngineGlobalAPIHandler

[--]

ah great. I just found this list I made when refactoring ::Importer. didnt know current state

isForwardedAPI might be useful

[Duncan]

how can you ever detect this properly? multiple DLLs can point at an API, so it's random to return an address...

[--]

I thought IsForwardedAPI means checking if an API forwards to another. not if sth points on an API

[Duncan]

it has something with APIAddress, which seems strange to me, because fowarded APIs dont have an rva, will check it in the original docs

yep, it's like this: example:

hModule = GetModuleHandleA("ntdll.dll");
ImporterIsForwardedAPI(hProcess, GetProcAddress(hModule, "RtlAllocateHeap"));
//Function would return TRUE because this API is a forward for kernel32.HeapAlloc