small problem with ImpRec

[TQN]

Can you upload the dumped.exe and dumped_.exe ?

[Hero]

Originally Posted by TQN

Can you upload the dumped.exe and dumped_.exe ?

Here you are:
http://rapidshare.com/files/128085736/Dump.rar.html
The IAT that I use to scan in Imprec is placed in 0x97d000 but Imprec makes new IAT starting 0xd5e000(Oh, Better I say,I mean FirstThunks).

Regards

[Nacho_dj]

Hello Hero:

What I find in your fixed dump is that the Original First Thunk and the First Thunk are in the .mackT section.

Original First Thunk begins at the offset: 0x95E000
First Thunk begins at the offset: 0x95EA90

They are pointed by the Import Table, beginning at the offset 0x95F520.

You could compare at these offsets that the values of either Thunk are the same in the dumped fixed file.

However, when you execute your target, in memory the Original First Thunk will get the handles of the functions in the places of the pointers to the names of functions, loaded by the system, becoming in that way the IAT. So in memory, content of Original First Thunk won't be the same than First Thunk.

Forget the previous Import Table of dumped at offset 0x595F84. It won't be used any more, since the tool has changed in Data Directories the Import Table Relative Virtual Address to 0x95F520.

But it is a right Import Table. Is there any issue for running the target?

Cheers

Nacho_dj

[Hero]

Hi Nacho
There is no problem in running dumped_fixed.exe on my computer,and this,itself is a problem...
I assume that addresses you told me are RVA-Base,if so yes,FirstThunk of App is at address 0x95EA90,But FirstThink should be 0x57d000, not 0x95EA90.
I were about to rebuild FirsthThunks at 0x57d000, but ImpRec create new IAT and i got FirsthThunks at 0x95EA90.
I didn't notice this at first too,But if you decompile dumped_fixed.exe,you will see that there is no reference to FirstThunks at address 0x95EA90.

Regards

[Nacho_dj]

OK, I am checking for instance the line at VA 0x9535F6. There you can find a call to CloseHandle function. In the dumped_fixed, do not why, it has not been fixed to the new Import Table by ImpRec, so it is calling to a non-sense address, and it is the old IAT. However, you are getting a working exe because at that address there is in your file the hardcoded handle (originated by the dump) of the function, so it works. If you test this executable in another machine, probably it won't work, as handles shouldn't be the same in different OS/kernel versions.

So, you should check that ImpRec has the options configured properly to fix all references to the new IAT...

Cheers

Nacho_dj