I unpacked OneWay.dll.(www.atma-software.com/1way)
This is the OEP I thought .
Code:
003D8458 55 push ebp
003D8459 8BEC mov ebp,esp
003D845B 83C4 C4 add esp,-3C
003D845E B8 58833D0>mov eax,OneWay.003D8358
003D8463 E8 BCDCFDF>call OneWay.003B6124
003D8468 33C0 xor eax,eax
I click the "Pick DLL" button.And I can see the Imagebase is 003B0000.
But When I choose OneWay.dll.
The Imagebase in the Log window is 00400000.
So I couldnot fix the unpacked dll.
see the attachment for two pictures discribe the problem I met.
What's the problem?
Import REConstructor bug?
Are there any alternative tools to fix the import table?
Confused.
Any comment is appreciated.
Thx!
------
Is this the same question of my previous thread?
http://forum.exetools.com/showthread.php?t=8612
Maybe this dll first packed with asprotect,then PEcompact.
Regards