small problem with ImpRec

[Hero]

Originally Posted by hobferret

Hero, use add new section, it always works

yea,it works even in my case too,but it works obviously by chance... :P
you know has happned?
right now,I have an IAT that ImpRec finds it.Assume it starts at address 0x57000.My program refers to this IAT(name this 1st IAT).
If you use 'Add new section',Imprec creates new section and generates new IAT for example at address 0xD7000(name this 2nd IAT).
1st IAT and 2nd IAT seems to be same and your program will work,because every API has been loaded for 2nd IAT,and base address of loaded DLL are normally the same,hence every FirstThunk in 2nd IAT will be equal to adress in 1st IAT that is stored statically.
But because you are using 1st IAT's static address,if DLLs load in any other address rather than their normal base address,your program will crash.
That's why you need use currect IAT(1st one) while repairing your IAT.

I wish I were able to explain what happens,My english is not very well.... :P

Regards