Imports

The gets() function we are hunting for is dynamically linked from the ucrtbased.dll file, therefore we should check the import table for it. Using the 010 Editor to find and parse the import table, as we see in the following screenshot, is not difficult:

Although it may be (and in fact is) an interesting process to manually parse a PE executable, it is much more convenient and easy to use one of the tools available out there. For example, IDA Pro would do all the dirty work for us.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset