Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 04-20-2019, 11:32
Mendax47 Mendax47 is offline
Friend
 
Join Date: Jun 2016
Location: Earth..
Posts: 102
Rept. Given: 0
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 207
Thanks Rcvd at 125 Times in 56 Posts
Mendax47 Reputation: 2
Question FThunk RVA Import Problem Need Help

I am having FThunk rva import problem in delphi which is using UPX Packer...

at first upx -d doesn't work... the unpacked binary doesn't run
https://i.imgur.com/kwWV5oT.png

in x64dbg i am having This FThunk rva import table problem

https://i.imgur.com/hGtaReT.png

Program Link:
https://mega.nz/#!9pAnXIAT!7S8hOV1sJ8wvwxHj6vUQs10QKzZv9wVRHhAbGeYKScE
Reply With Quote
The Following User Says Thank You to Mendax47 For This Useful Post:
Indigo (07-19-2019)
  #2  
Old 04-20-2019, 16:57
deepzero's Avatar
deepzero deepzero is offline
VIP
 
Join Date: Mar 2010
Location: Europe
Posts: 215
Rept. Given: 99
Rept. Rcvd 60 Times in 38 Posts
Thanks Given: 83
Thanks Rcvd at 95 Times in 50 Posts
deepzero Reputation: 60
1. upx -d works perfectly. If your exe doesnt run after, it's because of an integrity check. Debug it.

2. your OEP is right, but I dont know how you arrive at those IAT numbers. Using the same scylla version as you, scylla correctly finds the entire IAT with VA:004AE5C0 and Size:0000042C.


3. Hint: For the integrity check, look around 0x00489BC6.


Once the integrity check is patched, the unpacked file works.
Reply With Quote
The Following 4 Users Say Thank You to deepzero For This Useful Post:
Indigo (07-19-2019), Mendax47 (04-20-2019), niculaita (04-21-2019), tonyweb (04-21-2019)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
import ida_bytes problem eychei General Discussion 8 04-12-2018 02:27
Unpack OneWay.dll problem,Import REConstructor v1.6 Final fails. winndy General Discussion 3 01-07-2006 10:22
Import Rebuilding Without Import Table Kerlingen General Discussion 11 01-13-2005 10:24


All times are GMT +8. The time now is 11:14.


��ICP��05004977��
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX