Newbie question ASPR 1.23 RC4 (long!)

Ok, here's the easy way to be rid of the .mackt section:

As I said earlier, the section at 22A000 is called .idata, and was the original IAT/import table before packing, but ASProtect makes it unusable. So, we can use that section again for the new imports, with very little work.

In ImpRec, you see a groupbox called New Import Infos, and in there, there is a checkbox called Add new section, which is checked by default. If you uncheck that, you can now set the RVA that you want the imports to be written to. So, we first try putting 22A000 in there, and hit Fix Dump. We get a warning saying that the IAT will be overwritten if we continue. This doesn't look good , but lets continue anyway. Continue to fix dump, then go into LordPE or PE Tools or whatever, and change the location of the import table to 22A000 and the size of the import table to the size that ImpRec tells us it is. But, when we try to run the app, it doesn't work .

Ok, we need a new approach. If you click on options in ImpRec, we see quite a few things we can configure. One groupbox in particular looks interesting, New Imports. In there is an option called Create New IAT. Well, if we create a new IAT, it wont matter if we overwrite the old one, does it? So lets check that and hit OK. Still with Add new section unchecked and 22A000 put in the RVA box, lets hit fix dump again. This time we don't get a warning, looking good... It takes a while, then is done giving us a "success" status. When we go to fix the import table size and location in LordPE, we see that ImpRec has already fixed these things for us. Good! Let's try to run it. Unfortunately, that doesn't work either.

But that doesn't mean we aren't on the right track. Actually, we did exactly the right thing, but there's one thing ImpRec doesn't do for us that we still need to do manually (it seems to me this is either a bug in ImpRec, or a feature that should really be added..). Before we fix dump, we need to go zero out the contents of the entire .idata section. What is happening, is that ImpRec is overwriting the portions it needs to, but leaving garbage data in the remainder of the section.

So, in our dumped file before running ImpRec, lets open it in WinHex (or your hex editor of choice), go to 22A000, select the size of that section, and fill the whole section with 00s. In WinHex, you can do this by hitting Ctrl+L, and with Fill With Hex Values selected, leave in 00 as the value, and hit OK. Once that's done, save the file, and go back to ImpRec. With Create New IAT still checked, and Add New Section still unchecked, and 22A000 still in the RVA, do fix dump. Once again, it takes a while, and once its done, we see in LordPE that the import table location and size has been fixed for us just like last time. But unlike last time, when we try to run the exe, it works!

So, that wasn't so bad. By just clearing the .idata section before running ImpRec, and running ImpRec with the right options, we can be rid of the unnecessary .mackt section. Definately much easier than correcting all the imports by hand, no?

Regards,
Satyric0n