Tamper DLL Export Names & GetProcAddress Spoofing

Created the Thursday 11 August 2022. Updated 5 months, 4 weeks ago.

When a process is running, it is possible to change the results of the call to GetProcAddress API, for the exported functions of a module along with modifying the export's offsets and name at runtime.

For example, the offset of kernel32.dll's function VirtualAlloc can be change to the offset of another function. When VirtualAlloc is called (after getting its address from GetProcAddress), the second function will be called instead.

To achieve this, it is possible to use the WINAPI MapAndLoad from ImageHlp.h, then use ImageDirectoryEntryToData to get the list of exports. Then the ImageRvaToVa API can be used to retrieve each exported functions names offset; if desired the export name can be overwritten, resulting in calls to GetProcAddress with that export name to fail or be directed to another function.

Technique Identifier


Code Snippets

Detection Rules


Subscribe to our Newsletter

The information entered into this form is mandatory. It will be subjected to computer processing. It is processed by computer in order to support our users and readers. The recipients of the data will be : contact@unprotect.it.

According to the Data Protection Act of January 6th, 1978, you have at any time, a right of access to and rectification of all of your personal data. If you wish to exercise this right and gain access to your personal data, please write to Thomas Roccia at contact@unprotect.it.

You may also oppose, for legitimate reasons, the processing of your personal data.