|
OK, I am checking for instance the line at VA 0x9535F6. There you can find a call to CloseHandle function. In the dumped_fixed, do not why, it has not been fixed to the new Import Table by ImpRec, so it is calling to a non-sense address, and it is the old IAT. However, you are getting a working exe because at that address there is in your file the hardcoded handle (originated by the dump) of the function, so it works. If you test this executable in another machine, probably it won't work, as handles shouldn't be the same in different OS/kernel versions.
So, you should check that ImpRec has the options configured properly to fix all references to the new IAT...
Cheers
Nacho_dj
__________________
http://arteam.accessroot.com
|