Dealing with IAT redirection

Hi,
Yesterday I was practicing unpacking. I downloaded tELock 0.96 frm exetools. I packed a simple messagebox proggy with it. I had checked IAT redirection while packing it. Now while trying to unpack it, ImpRec gives my invalid thunks. What do I do?


BTW, the original file was only 1K while the 'packed' file is 10K!!

Thomas Antony

[D-Jester]

I don't suppose you tried using the plugin for tELock 0.95 thats included in the ImpREC distribution?

Attatched tELock Plugins

[bgrimm]

Also using Trace Level 3 (trap) usually works.
Just cut any invalid thunks tracing does not resolve.

(Tested with file packed with TeLock with
default options (with IAT Redirection)).

-bg

Hi,
Thanx will try that. BTW, I found the source for the telock plugin in the importrec directory!! And I can't seem to download the file ??

Thomas Antony

[NeOXOeN]

i would like to suggest to you is to read some tuts about unpacking

First of you need to understand Pe stuction of file then you will know how to fix IAT.There are some great tuts about IAT here start reading it http://www.yates2k.net/



Next i would like to suggest to you is..that you start tracing the protection scene from begining that way you will find out how he redirects IAT and how to fix it.

There are also solutions made on web which can give you tips or solution how to solve it.IF you dont find it with google send me msg i will help you bye..


NEO