What are PE File Forwarded Exports?

In this video, we'll explore the concept of a forwarded export in a PE file. I'll walk you through what they are, how to identify them and how they are structured in a PE file. Finally, we will explore a sample program to see the final forwarded export function address.

Cybersecurity, reverse engineering, malware analysis and ethical hacking content!
🌶️ YouTube 👉🏻 Like, Comment & Subscribe!

00:00 Introduction
01:11 Looking at Kernel32 for a forwarded export
01:41 What is a forwarded export?
02:00 Identifying a forwarded export in 010 Editor
03:41 Navigating AddressOfNameOrdinals array
05:10 Navigating AddressOfFunctions array
05:44 Converting from an RVA to a file offset
07:57 An example program

[raulx]

Hello, Dr. Josh. I just found your channel, and I love it. After watching this series of videos, I thought it would be fun to see, statically, where an exception handler is. I noticed there is an "exception" header at the same level as "export" and "import". So, I wrote a small program that throws an exception, hoping to get something there. I didn't. Could you please give me a hint? For example, if there is a "try" block with multiple "catch" statements, I think there should be a mechanism to choose the correct place to return to.

[yonite]

Hi Dr. Good to see you. It has been a while