Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 07-06-2008, 19:43
Hero Hero is offline
VIP
 
Join Date: Jan 2005
Posts: 226
Rept. Given: 2
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 5
Thanks Rcvd at 2 Times in 2 Posts
Hero Reputation: 1
small problem with ImpRec

Hi all
When I were unpacking an application,I find out an strange problem.
My ImpRec gets every imprt correctly,and I can repair my dump with 'add new section' checked with no problem.
But I need to rebuild my current FirstThunks,so I uncheck 'add new section' and set RVA equal to RVA that I found my IAT in it(for example my RVA to 'Get Import' is 57000,I set RVA to fix dump 57000).
When I try to fix dump in his case,ImpRec corrupts my FirstThunks,so PE becomes invalid.
Am I doing something wrong?

Regards
__________________
I should look out my posts,or JMI gets mad on me!
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ImpRec bug ?!! Newbie_Cracker General Discussion 2 11-14-2006 21:06
Problems with Imprec 1.6f > ILCH General Discussion 6 11-18-2004 09:16
ImpREC.dll & reversing FEUERRADER General Discussion 0 02-17-2004 22:41
imprec question fotisl General Discussion 1 09-20-2002 06:09


All times are GMT +8. The time now is 17:42.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )