Go Back   Exetools > General > General Discussion


Thread Tools Display Modes
Old 04-20-2019, 11:32
Mendax47 Mendax47 is online now
Join Date: Jun 2016
Location: Earth..
Posts: 103
Rept. Given: 0
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 218
Thanks Rcvd at 125 Times in 56 Posts
Mendax47 Reputation: 2
Question FThunk RVA Import Problem Need Help

I am having FThunk rva import problem in delphi which is using UPX Packer...

at first upx -d doesn't work... the unpacked binary doesn't run

in x64dbg i am having This FThunk rva import table problem


Program Link:
Reply With Quote
The Following User Says Thank You to Mendax47 For This Useful Post:
Indigo (07-19-2019)
Old 04-20-2019, 16:57
deepzero's Avatar
deepzero deepzero is offline
Join Date: Mar 2010
Location: Europe
Posts: 218
Rept. Given: 99
Rept. Rcvd 60 Times in 38 Posts
Thanks Given: 85
Thanks Rcvd at 95 Times in 50 Posts
deepzero Reputation: 60
1. upx -d works perfectly. If your exe doesnt run after, it's because of an integrity check. Debug it.

2. your OEP is right, but I dont know how you arrive at those IAT numbers. Using the same scylla version as you, scylla correctly finds the entire IAT with VA:004AE5C0 and Size:0000042C.

3. Hint: For the integrity check, look around 0x00489BC6.

Once the integrity check is patched, the unpacked file works.
Reply With Quote
The Following 4 Users Say Thank You to deepzero For This Useful Post:
Indigo (07-19-2019), Mendax47 (04-20-2019), niculaita (04-21-2019), tonyweb (04-21-2019)

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
import ida_bytes problem eychei General Discussion 8 04-12-2018 02:27
Unpack OneWay.dll problem,Import REConstructor v1.6 Final fails. winndy General Discussion 3 01-07-2006 10:22
Import Rebuilding Without Import Table Kerlingen General Discussion 11 01-13-2005 10:24

All times are GMT +8. The time now is 08:45.

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX