frame_get_proc_addr

EMET == EAF protection
Each data directory is basically a structure defined as an IMAGE_DATA_DIRECTORY. And although data directory entries themselves are the same, each specific directory type is entirely unique. The definition of each defined data directory is described in "Predefined Sections" later in this article.

DataDirectory is the final 128 bytes of  OptionalHeader. the last member of IMAGE_NT_HEADERS

IMAGE_NT_HEADERS structure
Represents the PE header format.
Syntax
C++

typedef struct _IMAGE_NT_HEADERS {
  DWORD                 Signature;
  IMAGE_FILE_HEADER     FileHeader;
  IMAGE_OPTIONAL_HEADER OptionalHeader;
} IMAGE_NT_HEADERS, *PIMAGE_NT_HEADERS;

IMG:  http://3.bp.blogspot.com/-oNSLW0H7hH4/TvOh03f3kiI/AAAAAAAAAFE/UXfbLYLBcZM/s640/PE_Structure.jpg


The DataDirectory  is an array of 16 IMAGE_DATA_DIRECTORY structures, 8 bytes apiece, each relating to an important data structure in the PE file. Each array refers to a predefined item,such as the import table.
IMAGE_DATA_DIRECTORY
Each data directory entry specifies the size and relative virtual address of the directory. To locate a particular directory, you determine the relative address from the data directory array in the optional header. Then use the virtual address to determine which section the directory is in. Once you determine which section contains the directory, the section header for that section is then used to find the exact file offset location of the data directory.


IMAGE_DATA_DIRECTORY structure
Represents the data directory.
Syntax
C++

typedef struct _IMAGE_DATA_DIRECTORY {
  DWORD VirtualAddress;
  DWORD Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;

Members
VirtualAddress
The relative virtual address of the table.
Size
The size of the table, in bytes.


Data Directories :
// Directory Entries
// Export Directory
#define IMAGE_DIRECTORY_ENTRY_EXPORT         0
// Import Directory
#define IMAGE_DIRECTORY_ENTRY_IMPORT         1
// Resource Directory
#define IMAGE_DIRECTORY_ENTRY_RESOURCE       2
// Exception Directory
#define IMAGE_DIRECTORY_ENTRY_EXCEPTION      3
// Security Directory
#define IMAGE_DIRECTORY_ENTRY_SECURITY       4
// Base Relocation Table
#define IMAGE_DIRECTORY_ENTRY_BASERELOC      5
// Debug Directory
#define IMAGE_DIRECTORY_ENTRY_DEBUG          6
// Description String
#define IMAGE_DIRECTORY_ENTRY_COPYRIGHT      7
// Machine Value (MIPS GP)
#define IMAGE_DIRECTORY_ENTRY_GLOBALPTR      8
// TLS Directory
#define IMAGE_DIRECTORY_ENTRY_TLS            9
// Load Configuration Directory
#define IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG    10

Import data section, .idata
The .idata section is import data, including the import directory and import address name table
IMAGE_DIRECTORY_ENTRY_IMPORT directory is defined
Export data section, .edata
The .edata section contains export data for an application or DLL. When present, this section contains an export directory for getting to the export information.
IMG_DATA_DIRECTORY = 128 byte, 16 entires

Microsoft
ImageDirectoryEntryToData function

PVOID WINAPI ImageDirectoryEntryToData(
  _In_  PVOID   Base,
  _In_  BOOLEAN MappedAsImage,
  _In_  USHORT  DirectoryEntry,
  _Out_ PULONG  Size
);

Parameters
Base [in]
The base address of the image.
MappedAsImage [in]
If this parameter is TRUE, the file is mapped by the system as an image. If the flag is FALSE, the file is mapped as a data file by the MapViewOfFile function.
DirectoryEntry [in]
The index number of the desired directory entry. This parameter can be one of the following values.
For example

0:000> dt IMAGE_EXPORT_DIRECTORY
ole32!IMAGE_EXPORT_DIRECTORY
   +0x000 Characteristics  : Uint4B
   +0x004 TimeDateStamp    : Uint4B
   +0x008 MajorVersion     : Uint2B
   +0x00a MinorVersion     : Uint2B
   +0x00c Name             : Uint4B
   +0x010 Base             : Uint4B
   +0x014 NumberOfFunctions : Uint4B
   +0x018 NumberOfNames    : Uint4B
   +0x01c AddressOfFunctions : Uint4B
   +0x020 AddressOfNames   : Uint4B
   +0x024 AddressOfNameOrdinals : Uint4B
•	AddressOfFunctions: an array of RVAs of the functions in the module
•	AddressOfNames: an array of RVAs each corresponding to the function name strings of exported functions.
•	AddressOfNameOrdinals: This array is in sync with the AddressOfNames array and there is a one to one correspondence between the two. It gives an index or an offset into the AddressOfFunctions array to get the Address of the Function Name.
IMG : http://1.bp.blogspot.com/-gvRkb9W-jOw/UxNOhSv_B9I/AAAAAAAAB_s/cVTUhOhyJ30/s1600/Cc301808.PE2fig03(en-us,MSDN.10).gif
getdik snippete

Base TimeStamp                     Module
          400000 47b806f4 Feb 17 14:05:40 2008 C:\Users\moveax\poolobject\rooter.exe
00001000 size of heap commit
       0  DLL characteristics
       0 [       0] address [size] of Export Directory
   65000 [    260C] address [size] of Import Directory
   71000 [    9C00] address [size] of Resource Directory
       0 [       0] address [size] of Exception Directory
       0 [       0] address [size] of Security Directory
   6A000 [    6644] address [size] of Base Relocation Directory
       0 [       0] address [size] of Debug Directory
       0 [       0] address [size] of Description Directory
       0 [       0] address [size] of Special Directory
   69000 [      18] address [size] of Thread Storage Directory
       0 [       0] address [size] of Load Configuration Directory
       0 [       0] address [size] of Bound Import Directory
   65704 [     5EC] address [size] of Import Address Table Directory
       0 [       0] address [size] of Delay Import Directory
       0 [       0] address [size] of COR20 Header Directory
       0 [       0] address [size] of Reserved Directory

BASE+offset=RVA

0:001> dps 400000+65704 L348/4
00465704  76193ddc oleaut32!SysFreeString
00465708  76198b29 oleaut32!SysReAllocStringLen
0046570c  76194042 oleaut32!SysAllocStringLen
00465710  00000000
00465714  762211a8 advapi32!RegQueryValueExAStub
00465718  76221197 advapi32!RegOpenKeyExAStub
0046571c  76221164 advapi32!RegCloseKeyStub
00465720  00000000
00465724  754c2379 user32!GetKeyboardType
00465728  752dc030 apphelp!DWM8AND16BitHook_DestroyWindow
0046572c  754941cf user32!LoadStringA
00465730  7532cfd9 apphelp!SrHook_MessageBoxA
00465734  75489fbd user32!CharNextAStub
00465738  00000000
0046573c  75d39864 KERNEL32!GetACPStub
00465740  75d398c0 KERNEL32!SleepStub
00465744  75d337a0 KERNEL32!VirtualFreeStub
00465748  75d337c0 KERNEL32!VirtualAllocStub
0046574c  75d31960 KERNEL32!GetCurrentThreadId
00465750  75d39067 KERNEL32!InterlockedDecrementStub
00465754  75d38f69 KERNEL32!InterlockedIncrementStub
00465758  75d39a6e KERNEL32!VirtualQueryStub

EMET bypass using function ImageDirectoryEntryToData (via IAT)



(bu yaxınlarda yeni hazırladığımız kernel ilə bağlı məqalələr yerləşdirəcəm)
references: http://bsodtutorials.blogspot.com/2014/03/import-address-tables-and-export.html
https://msdn.microsoft.com/en-us/magazine/cc301808.aspx
http://win32assembly.programminghorizon.com/pe-tut7.html
http://www.csn.ul.ie/~caolan/pub/winresdump/winresdump/doc/pefile2.html
http://trapmine.com/the-enfal-apt-is-back/

emingh _ ~köhnə günlərə qayıdırıq az qalıb ;)~