Skip to content

Removing imports from the IAT in metsrv - #810

Open
dledda-r7 wants to merge 2 commits into
rapid7:masterfrom
dledda-r7:feat/remove-imports-metsrv-3
Open

Removing imports from the IAT in metsrv#810
dledda-r7 wants to merge 2 commits into
rapid7:masterfrom
dledda-r7:feat/remove-imports-metsrv-3

Conversation

@dledda-r7

Copy link
Copy Markdown
Contributor

Removing imports ✂️

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@dledda-r7

Copy link
Copy Markdown
Contributor Author

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

neither copilot want to review my code :sadness:

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

c/meterpreter/source/metsrv/server_setup.c:388

  • Important: Problem: this still calls GetUserObjectInformationA/GetThreadDesktop directly rather than via met_api->win_api.* like the rest of the PR. Impact: leaves user32 imports in the IAT and contradicts the stated goal of removing imports. Fix: route both calls through met_api->win_api.user32 wrappers.
			GetUserObjectInformationA(met_api->win_api.user32.GetProcessWindowStation(), UOI_NAME, &stationName, 256, NULL);
			remote->orig_station_name = _strdup(stationName);
			remote->curr_station_name = _strdup(stationName);
			GetUserObjectInformationA(GetThreadDesktop(GetCurrentThreadId()), UOI_NAME, &desktopName, 256, NULL);

c/meterpreter/source/metsrv/winapi.c:219

  • Suggestion: Problem: the forwarder-resolution comment claims support for ".#Ordinal" forwarders, but the implementation always re-hashes the substring after '.' and will not resolve ordinals. Impact: the comment is misleading and makes future maintenance/debugging harder. Fix: either implement ordinal parsing or adjust the comment to match current behavior.
            // Forwarder detection: if the RVA falls inside the export directory,
            // the "address" is actually a forwarder string of the form
            // "TargetDll.TargetFunction" (or ".#Ordinal"). We must resolve it in
            // the target DLL rather than returning the string as a function.

Comment thread c/meterpreter/source/metsrv/packet_encryption.c

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

@msutovsky-r7 msutovsky-r7 self-assigned this Aug 11, 2026
@dledda-r7

Copy link
Copy Markdown
Contributor Author

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

skills issues

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

3 participants