Import Rebuilding Without Import Table

You may use ImportReconstructor to rebuild import table, but some packers
like asprotect take some api's like GetCurrentThread - and move those value to
theirs memory - that inport reconstructor can't find any api on current offset, other api is GetCommandLineA - those apis you must rebuild manually - put only the corrent offet in imprect

I did unpacking app like your case.

my case was Starforce. (3 years ago.. hugh~~)

SF used emulating of Kernel,GDI,User process.

first I dumped code section, & alpha.dll (It emulate imported function)

and I checked all opcode pointed on alpha.dll in code section.

like call alpha.xxxx
jmp alpha.xxxx
mov reg32,alpha.xxxx

I gathering all opcode address & referece address point.
and I made new IAT by gathered information.

gathering is so Hard or not.

If you want find Making Import table, Check hxxp://win32asm.cjb.net <Iczelion's Win32 Assembly Homepage>

There good information about PE File format.