IAT Hooking ExitProcess on own process - winapi

Question

I`d like to ask a question regarding IAT hooking on my own process .
I am currently trying to hook ExitProcess so it would run a certain function before any ExitProcess call, and I am facing some troubles .
I am traversing the PE at runtime, going through the IMAGE_IMPORT_DESCRIPTOR ,
after finding kernel32.dll there (which is the first .dll) I am traversing it THUNK_DATA-s by name, trying to find ExitProcess there, though with no luck.
Logging the functions, those are the functions which are found there -
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetModuleFileNameW
FreeLibrary
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryW
lstrlenA
LoadLibraryExW
GetLastError
RaiseException
IsDebuggerPresent
DecodePointer
EncodePointer
GetModuleHandleW
Though ExitProcess is nowhere within .
I have tried enumerating by function pointers instead of the names (using thunkdata instead of originalthunkdata) though it has failed as well.
GetProcAddress for ExitProcess does return a pointer within the PE, and I have tried to load kernel32.dll forcefully (though it should be loaded automatically) by loadlibrary, though the result is the same.
What could be the problem ?
HMODULE hMod = GetModuleHandle(NULL);
PIMAGE_DOS_HEADER pImgDosHeaders = (PIMAGE_DOS_HEADER)hMod;
PIMAGE_NT_HEADERS pImgNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)pImgDosHeaders + pImgDosHeaders->e_lfanew);
PIMAGE_IMPORT_DESCRIPTOR pImgImportDesc = (PIMAGE_IMPORT_DESCRIPTOR)((LPBYTE)pImgDosHeaders + pImgNTHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
UINT indx = 0;
while(strcmpi((PCHAR)((LPBYTE)pImgDosHeaders + pImgImportDesc[indx].Name), "kernel32.dll")) { ++indx; };
PIMAGE_THUNK_DATA pImgThunkData = (PIMAGE_THUNK_DATA)((LPBYTE)pImgDosHeaders +pImgImportDesc[indx].OriginalFirstThunk);
PIMAGE_IMPORT_BY_NAME pImgImportByName = NULL;
for(;pImgThunkData->u1.Function; ++pImgThunkData)
{
pImgImportByName = (PIMAGE_IMPORT_BY_NAME)((LPBYTE)pImgDosHeaders + pImgThunkData->u1.AddressOfData);
!strcmpi("ExitProcess",pImgImportByName->Name) ? cout << "ExitProcess Found" : false;
}
return true;
Thank you so very much and have a great day !

Answer 1

If your app does not call ExitProcess() statically, such as if it is not called at all (not even by your app's RTL) or if it is loaded dynamically via GetProcAddress(), then it will not be present in your app's IMPORTS table. The IMPORTS table only lists functions that your app statically links to. That is likely why your code does not find it. Use a utility like PEDUMP or DependancyWalker to make sure your app is actually statically linking to ExitProcess(). For example, in my dev environment (C++Builder XE2), if I create a console project, ExitProcess() is not found in the IMPORTS table, but if I create a GUI project instead then it is found. The difference is that the two types of project use different RTLs under the hood, so apparently the console RTL does not use ExitProcess() when the app terminates.