Method II requires completely rebuilding `.idata` section, such as to: 1. `ImportDirectory` deserialization: 1. iterate through every entry (each DLL). 1. for each entry, iterate INT/IAT and extract every imported function's Hint/Name **RVA**. 1. lookup **RVA** for the value of the Hint/Name. 1. copy the value into an `ImportFunction` auxiliary struct. 2. calculate where everything **will** go, use offsets for each block. 3. serialize each `ImportDirectory` and its `ImportFunction`s with the new **payload** entries. > [!WARNING] > I may have forgotten a step or other important details about how to implement this.
Method II requires completely rebuilding
.idatasection, such as to:ImportDirectorydeserialization:ImportFunctionauxiliary struct.ImportDirectoryand itsImportFunctions with the new payload entries.Warning
I may have forgotten a step or other important details about how to implement this.