Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   FThunk RVA Import Problem Need Help (https://forum.exetools.com/showthread.php?t=19200)

Mendax47 04-20-2019 11:32

FThunk RVA Import Problem Need Help
 
I am having FThunk rva import problem in delphi which is using UPX Packer...

at first upx -d doesn't work... the unpacked binary doesn't run
https://i.imgur.com/kwWV5oT.png

in x64dbg i am having This FThunk rva import table problem

https://i.imgur.com/hGtaReT.png

Program Link:
https://mega.nz/#!9pAnXIAT!7S8hOV1sJ8wvwxHj6vUQs10QKzZv9wVRHhAbGeYKScE

deepzero 04-20-2019 16:57

1. upx -d works perfectly. If your exe doesnt run after, it's because of an integrity check. Debug it.

2. your OEP is right, but I dont know how you arrive at those IAT numbers. Using the same scylla version as you, scylla correctly finds the entire IAT with VA:004AE5C0 and Size:0000042C.


3. Hint: For the integrity check, look around 0x00489BC6.


Once the integrity check is patched, the unpacked file works.


All times are GMT +8. The time now is 19:11.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX