title: Fill in DLL import table manually: IMAGE_IMPORT_DESCRIPTOR's Name field stores 0x0000FFFF
body: <p>My goal is to fill in Dll's import table manually in order to hook internal LoadLibrary calls (when you load library it may load another library inside its DllMain).</p>
  
  <p>Here is my code which fill in Import table recursively for each dll in dependecies hierarchy and it works fine except some dlls (<strong>api-ms-win-crt-locale-l1-1-0.dll</strong> in this case).</p>
  
  <pre class="lang-cpp prettyprint-override"><code>void PEUtility::fillImportTable(HMODULE loadedModule, FillImportFlag flag, std::function&lt;void(HMODULE&amp;)&gt; callback)
  {
      std::stack&lt;HMODULE&gt; modules;
      modules.push(loadedModule);
  
      while (modules.size())
      {
          auto module = modules.top();
          modules.pop();
  
          auto imageBase = (DWORD_PTR)module;
  
          auto header = ImageNtHeader(module);
          auto importTable = (PIMAGE_IMPORT_DESCRIPTOR)(DWORD_PTR)(header-&gt;OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress + imageBase);
  
          while (importTable-&gt;OriginalFirstThunk)
          {
  // !!!
  // HERE I've got an error: importTable-&gt;Name stores 0x0000FFFF instead dll name
  // !!!
              auto importedModuleName = (char*)(DWORD_PTR)(importTable-&gt;Name + imageBase);
              auto importedModule = GetModuleHandleA(importedModuleName);
              if (!importedModule)
              {
                  importedModule = LoadLibraryExA(importedModuleName, 0, DONT_RESOLVE_DLL_REFERENCES);
                  if (flag == FillImportFlag::Recursive)
                      modules.push(importedModule);
              }
  
              auto nameAddressPtr = (PIMAGE_THUNK_DATA)(DWORD_PTR)(importTable-&gt;OriginalFirstThunk + imageBase); //Import Lookup Table address (functions names)
              auto functionAddressPtr = (PIMAGE_THUNK_DATA)(DWORD_PTR)(importTable-&gt;FirstThunk + imageBase); //Import Address Table (IAT) address (functions addresses)
  
              while (nameAddressPtr-&gt;u1.Function)
              {
                  FARPROC importedFunctionPtr = NULL;
                  if (nameAddressPtr-&gt;u1.Ordinal &amp; IMAGE_ORDINAL_FLAG)
                  {
                      importedFunctionPtr = GetProcAddress(importedModule, MAKEINTRESOURCEA(nameAddressPtr-&gt;u1.Ordinal));
                  }
                  else
                  {
                      auto impotByNameImage = (PIMAGE_IMPORT_BY_NAME)(DWORD_PTR)(nameAddressPtr-&gt;u1.AddressOfData + imageBase);
                      importedFunctionPtr = GetProcAddress(importedModule, (char*)impotByNameImage-&gt;Name);
                  }
  
                  if (importedFunctionPtr)
                  {
                      auto oldProt = 0ul;
                      VirtualProtect(functionAddressPtr, sizeof(IMAGE_THUNK_DATA), PAGE_EXECUTE_READWRITE, &amp;oldProt);
                      functionAddressPtr-&gt;u1.Function = (DWORD_PTR)importedFunctionPtr;
                  }
  
                  nameAddressPtr++;
                  functionAddressPtr++;
              }
  
              importTable++;
          }
  
  // HERE in callback I hook LoadLibrary &amp; RegQueryVAlue calls if 'module' has such dependencies
          callback(module);
      }
  }
  </code></pre>
  
  <p>The problem is that the <code>Name</code> field of <code>IMAGE_IMPORT_DESCRIPTOR</code> structure stores <code>0x0000FFFF</code> instead of Dll name. </p>
  
  <p>So my question is how can I fix that? What does <code>0x0000FFFF</code> mean? Maybe this is some "special" module (see <strong>api-ms-win-crt-locale-l1-1-0.dll</strong> below on screenshot)?</p>
  
  <p>Here is screenshot from my debug session.
  <a href="https://i.stack.imgur.com/KmkwT.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/KmkwT.png" alt="enter image description here"></a></p>
  
  <h1>UPDATE:</h1>
  
  <p>Maybe 0x0000FFFF means that dll doesn't have dependencies?</p>
  
  <p>I've looked <strong>api-ms-win-crt-locale-l1-1-0.dll</strong> dependencies in Dependency Walker and seems this dll has nothing to import. </p>