Modifying a static Library

0) Background

There is a static library called Slib.lib, which contains two obj files:

    expofunc1.obj        void sayHello1 () {printf ("Hello 1\n");}         void  sayWorld1 () {}    expofunc2.obj        void SayHello2 () {printf ("  Hello 2\n");}    

Modify the SayHello1 so that the output is not valid-that is, "Hello 1" is not printed.

A split static library into obj1) Split the static lib into obj:

[Cmd]>lib/list slib.lib >slib.txt

Generate Text: Slib.txt:

9.00. 21022.08 Copyright (C) Microsoft Corporation. All rights reserved. \debug\stdafx.obj.\debug\expofunc1.obj.\debug\expofunc2.obj

2) Edit Text slib.txt:

Lib Slib.lib//extract:.\debug\expofunc2.obj

3) Modify Slib.txt to Slib.bat4) Execute Slib.bat

Extract from Slib.lib:

Expofunc1.objexpofunc2.obj

See the symbols involved in Expofunc1.obj:

DUMPBIN Expofunc1.obj/symbols

Two concerns obj5) dump Oxpofunc1.obj

DUMPBIN Expofunc1.obj/all > Expofunc1_dmp.txt

Open Expofunc1_dmp.txt and search for "SayHello1" with the following structure:

Section HEADER # to. Text name0Physical Address0 VirtualAddress thesize of raw data 4CFD file pointer to raw data (00004CFD to 00004D45) 4d46 file pointer to Relo cation table0file pointer to line numbers4Number of relocations0Number of line numbers60501020flags Code comdat; sym="void __cdecl sayHello1 (void)"(?[email protected] @YAXXZ) - bytealign Execute Read RAW DATA # to          00000000: -8B ECBayiEC C0xx xx xx  -  About  $8D BD +FF U.ì.ìà[email protected]?00000010: FF FF B9 - xx xx xxB8 cc cc CC cc F3 AB 8B F4??Ten...? Ììììó?.?00000020: the xx xx xx xxFf the xx xx xx xx  theC4Geneva3 b F4 h ...? ......?.;?00000030: E8xx xx xx xx5F 5E 5BBayiC4 C0xx xx xx3 b ecè...._^[.?à ...; ì00000040: E8xx xx xx xx8B E5 5D c3è ...]?Relocations # tosymbol symbol Offset Type applied T o Index Name--------  ----------------  -----------------  --------  ------00000021DIR3200000000CB [email protected][email protected]?Wuyi?6[Email protected] (`string')         00000027DIR3200000000C7 __imp__printf 00000031REL3200000000CC __rtc_checkesp00000041REL3200000000CC __rtc_checkesp

Each function here corresponds to a section.
Here SayHello1 is in section header #31, look at relocations #31, here is the section header #31 reference symbol, because there is no link stage, so the address of these symbols is unknown.

        00000027DIR3200000000C7 __imp__printf//The offset 0x27 part of the RAW DATA #31 segment refers to the __imp__printf,
Take a look at the RAW DATA #31:        00000020: the xx xx xx xx  FF   -XX  theC4Geneva3 b F4 h ...?                                       ......?.;? ^^^^^^^^^^^it4 A byteShould be the address of the __imp__printf, at the link stage when the __imp__printf address is determined, __imp__printf's real address will be populated xx xx     　　 "FF"is the call command machine code, if you want to make __imp__printf invalid, skip this function directly, (__imp__printf is the __cdel, without the balance of stack), the"FF"Modify to become"EB"Can."EB"Is forward jmp4 byteMachine code, this can jump directly to call __imp__printf next command.

Three Modify obj

Using the notepad++ hex-editor plugin

Four modified obj re-packaged into a static library

[Cmd]>lib/out:slib.lib expofunc1.obj Expofunc2.obj

The generated slib.lib is the modified static library.

Modifying a static Library