Import OS Fixing

[MaRKuS-DJM]

maybe i asked this question some time before, but i never got a good answer (or tutorial) for it. My problem is, if i unpack a target and fix the imports by imprec, it doesn't run on any other OS than mine (normally i use Windows XP). is there a way to fix these imports for every OS? i thought maybe LordPE can do the job, but it doesn't.

Any help would be appreciated.
many thanks

I'm not too sure if I'm right but I think it could be caused by something called api forwarding. I think it works like that; you have app that uses some api, which doesn't exist on the other OS, but there is api with another name and the some function. In the dll where the api used to be is just reference to the new one and thats where the call finaly lands. But the import rebuilder reconstructs import table using the new name, so on older OS it won't run.
I just probably wrote a real $hit but I think it could be like that
Regards,
least

Yeah same experience here. The patches which I make for Packed program (eg. ASPACK) only works on WinXP/2K and fails on 98/ME. It's the API issue.

Regards,
ferrari

[JMI]

From what I've read elsewhere, I believe the main issue is that some of the API's have different names and maybe ordinals between 9X and NT based OS systems. I've never used a dual boot system and never tried to use a patched program I'd made on another OS, so didn't pay that close attention, other than the quick read.

I think I read some threads on the issue on the Woodmann Forum, but don't have time at the moment to try to find them for you. I'll post something later, if I get the chance.

Regards,

Study more, my friend. The answer is easy - it is called OriginalFirstThunk.

Long ago I wrote an article about all that, but it is in Russian - sorry...
http://wasm.ru/article.php?article=packlast01

You could probably just see the pictures. I can translate them right here.

yah, now when you want to create patches..this becames problematic..

first of all: better is not to use automated tools, but try clear manual unpacking;
ok, this can be too much hard for you.

than 2nd suggestion:
unpack on both W9x & Nt systems, then compare RESOLVED imports;
when you see difference, now you need in debugger confirm exact import name;

(usually RestoreLastError sux:)

[MaRKuS-DJM]

Originally Posted by JMI

I think I read some threads on the issue on the Woodmann Forum, but don't have time at the moment to try to find them for you. I'll post something later, if I get the chance.

thanks JMI. i have already read some threads on Woodman of this issue, but didn't find something really helpful. maybe you saw other threads

Originally Posted by volodya

Study more, my friend. The answer is easy - it is called OriginalFirstThunk.

There's a option in ImpRec... "Import Original FT".
does this solve the problem? i never tried it.

Originally Posted by evaluator

first of all: better is not to use automated tools, but try clear manual unpacking;

i'm getting closer to it. but all i did for now was to write some functions which resolved imports for me, no ImpRec Disassembly or Tracer fix. so i got only valid imports in ImpRec. i'm at some "semi-manual" unpacker level.

Originally Posted by evaluator

unpack on both W9x & Nt systems, then compare RESOLVED imports;
when you see difference, now you need in debugger confirm exact import name;

do you think this is a good method? it seems a bit time-consuming to do this for every packer...