Bottom of lockdown.c->hash_file()
you have a for loop calling hash1
Which is calling it for each of the sections of the pe file.
the .rdata section is like the 3rd one (depends on the file)
Take a look at DATA_DIRECTORY(13): Import Address Table
It ALWAYS points to the beginning of the .rdata in memory.
hash2 nabs sections of memory where the pe sections are stored.
The 1st one hashed from .rdata is the IAT.
Bah.. look at your code you should know!
Oh wait you still have them as eax,esi,var_20, ptr_section
Anyways... I jsut need to know how to populate the IAT like the loader does.
Except in java, and without GetModuleHandle()
... though like I said I could write a function that nabs out all that info.
And as for qsort, how does ti sort the data? I saw sort_func which makes seince, but what does qsort do with that info?
walk through the memory space.. if sort_func(ptr, ptr+4) = -1 move ptr+4 -4, if 1 move ....
w/e i'll figure it out tonight and hopefully get lockdown working in java.
~Hdx