|
There is no problem with IAT. I got a fully unpacked file by Revirgin.
I couldn't attach the sample,so get it from rapidshare.com.
h++p://rapidshare.com/files/3315837/Sample_DLL.rar.html
The archive contains the dumped & unpacked DLL. Load unpacked DLL by OllyDbg, grap its imports address using ImpRec, then try to fix the dumped DLL.
Now, plz look at 0F588AB8. It should be VirtualQuery (first error in run-time). Use Hiew to see the API. 'Cause I dumped it in WinXP SP2, maybe you'll see correct API in OllyDbg.
__________________
In memory of UnREal RCE...
|