Import OS Fixing
 

maybe i asked this question some time before, but i never got a good answer (or tutorial) for it. My problem is, if i unpack a target and fix the imports by imprec, it doesn't run on any other OS than mine (normally i use Windows XP). is there a way to fix these imports for every OS? i thought maybe LordPE can do the job, but it doesn't.

Any help would be appreciated.
many thanks

I'm not too sure if I'm right but I think it could be caused by something called api forwarding. I think it works like that; you have app that uses some api, which doesn't exist on the other OS, but there is api with another name and the some function. In the dll where the api used to be is just reference to the new one and thats where the call finaly lands. But the import rebuilder reconstructs import table using the new name, so on older OS it won't run.
I just probably wrote a real $hit but I think it could be like that;)
Regards,
least

Yeah same experience here. The patches which I make for Packed program (eg. ASPACK) only works on WinXP/2K and fails on 98/ME. It's the API issue.

Regards,
ferrari :)

From what I've read elsewhere, I believe the main issue is that some of the API's have different names and maybe ordinals between 9X and NT based OS systems. I've never used a dual boot system and never tried to use a patched program I'd made on another OS, so didn't pay that close attention, other than the quick read.

I think I read some threads on the issue on the Woodmann Forum, but don't have time at the moment to try to find them for you. I'll post something later, if I get the chance.

Regards,

Study more, my friend. The answer is easy - it is called OriginalFirstThunk.

Long ago I wrote an article about all that, but it is in Russian - sorry...
http://wasm.ru/article.php?article=packlast01

You could probably just see the pictures. I can translate them right here.

yah, now when you want to create patches..this becames problematic..

first of all: better is not to use automated tools, but try clear manual unpacking;
ok, this can be too much hard for you.

than 2nd suggestion:
unpack on both W9x & Nt systems, then compare RESOLVED imports;
when you see difference, now you need in debugger confirm exact import name;

(usually RestoreLastError sux:)

thanks JMI. i have already read some threads on Woodman of this issue, but didn't find something really helpful. maybe you saw other threads :)

There's a option in ImpRec... "Import Original FT".
does this solve the problem? i never tried it.

i'm getting closer to it. but all i did for now was to write some functions which resolved imports for me, no ImpRec Disassembly or Tracer fix. so i got only valid imports in ImpRec. i'm at some "semi-manual" unpacker level.

do you think this is a good method? it seems a bit time-consuming to do this for every packer...

huh?
if you are seeking COMFORT, than big sorriE!

1. you need do this comparision if only you are going to share your workz;
2. also there is old future for w9x, called import Renormalizing.. can be usefull;
(but some prots can detect it)

i'm not searching comfort, but i thought there would be a easier way to get OriginalFirstThunk. for very much targets i did inline-patching, but i've never seen a inline-patch for Asprotect 1.23. but as i see, ASPR-Stripper is able to fix the imports for every OS without any problems

mostly i think, aspr-stripper not resolves imports but grabs them from aspr;
so all is ok;


>OriginalFirstThunk
?? you are messing something..

OriginalFirstThunk
i think it should fix the problem?

maybe i should read some tutorials for Import Table... do you know a good one?
PS: i found some description how to fix for every OS in safedisc... it's a very long article, but maybe it helps

MaRKuS-DJM
 

If I remember correctly Lunar_Dust released a First_Thunk_Rebuilder, never had occasion to use it so I don't know if will help you with your problem, may be worth checking out.

i think it's worth a try :) thanks you!

EDIT: i see this tool does exactly the same as the option in imprec "Rebuild Original FT"
i wasn't able to test it if it works (till now) :)

PS: does it make sense to import by ordinal?

Hi
400000+3c---> offset to pe signature, add to whatever there 80H, then there is an RVA to IMPORTDirectory.

regards.

Markus, that unpacked PEC on ftp are your?