View Single Post
  #9  
Old 07-10-2008, 23:44
Hero Hero is offline
VIP
 
Join Date: Jan 2005
Posts: 226
Rept. Given: 2
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 5
Thanks Rcvd at 2 Times in 2 Posts
Hero Reputation: 1
Hi Nacho
There is no problem in running dumped_fixed.exe on my computer,and this,itself is a problem...
I assume that addresses you told me are RVA-Base,if so yes,FirstThunk of App is at address 0x95EA90,But FirstThink should be 0x57d000, not 0x95EA90.
I were about to rebuild FirsthThunks at 0x57d000, but ImpRec create new IAT and i got FirsthThunks at 0x95EA90.
I didn't notice this at first too,But if you decompile dumped_fixed.exe,you will see that there is no reference to FirstThunks at address 0x95EA90.

Regards
__________________
I should look out my posts,or JMI gets mad on me!
Reply With Quote