The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The attributes it shows are address of the function, name and library from which it got imported as shown in this screenshot snippet:Is there a way for me through scripting (IDC or Python, I don't care too much), to add imports of my own to the list and, for example, have them point (the address attribute) to code such as this (highlighted line)?:I.e. the line would in such case look like:0DCBA987     GetLongPathNameW       kernel32.dllor even just0DCBA987     GetLongPathNameW       ???assuming the above call GetProcAddress would be at address 0DCBA987.The advantage to me would be readability. But it would also yield a more comprehensive list of imports (and consequently xrefs) as some functions are frequently imported dynamically due to their availability in the various Windows versions.It should be quite trivial given a certain binary to figure out all xrefs to candidate functions that retrieve the imported function's address (such as GetProcAddress) and then walk their calls to find which function was imported. The DLL part may be more complicated to find out, but it could be left empty or entered manually. But I didn't find a function that would allow me to add imports. Is there a way?
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
ida;idapython;idapro plugins;import reconstruction
I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different.IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such segments won't display the usual code/data listings, function definitions and most of the other stuff we're used to in the Code View.More specifically, adding code to those segments will be hidden in IDA, which will refuse displaying any assembly in those segments. A nice Anti-IDA trick I'd say :)Instead, they'll only display name definitions, offsets and comments.Once an offset is assigned a name of an API stored in IDA's database, IDA will get the API's prototype and other info, assign type definition and comments.IIRC These APIs will also be shown in the imports window but i'm not sure what exactly triggers this. it might also depend on IDA versions and other import-related PE properties.EDITIt's been more than three years and obviously I couldn't find the script then, and I just went over some old code of mine and were able to reconstruct what I did in that script, and here is the gist of it:import idaapiimport idcfor import_rva, import_name in LIST_OF_IMPORTS:    ea = imagebase + import_rva    if idaapi.get_segm_class(getseg(ea)) == XTRN:        print(import is already inside an XTRN segment,               assuming it's correctly named)        continue    elif idaapi.get_segm_class(getseg(ea-1)) == XTRN:        print(Import is just below an import segment,               extending segment to include this additional import)        # shrinking it's current segment        # WARNING: this assumes current import is at the top of its segment        # otherwise we'll have to SPLIT the import's current segment        # and to that I say CBA aka left as an exercise to the reader        idaapi.set_segm_start(ea, SegStart(ea)+4, 0)        # expanding it's new segment        idaapi.set_segm_end(ea-1, SegEnd(ea-1)+4, 0)    else:        print(Creating new segment for import)        idc.AddSeg(ea, ea+4, 0, 1, 4, 0)        idc.SetSegClass(ea, XTRN)    # renaming import to API name. This will make IDA add type    # information and automatic comments for any function it's    # familiar with    idc.MakeName(ea, import_name)    # Making it an offset to have IDA show it as an import instead    # of hiding it    idc.MakeDword(ea)