What is import reconstruction and why is it necessary?

Question

When reading about unpacking, I sometimes see an "import reconstruction" step. What is this and why is it necessary?

Answer 1

In a typical, non-packed Windows PE executable, the header contains metadata that describes to the operating system which symbols from other libraries that the executable depends upon. The operating system's loader is responsible for loading those libraries into memory (if they are not already loaded), and for placing the addresses of those imported symbols into structures (whose locations are also specified by the metadata) within the executable's memory image. Packers, on the other hand, often destroy this metadata, and instead perform the resolution stage (which would normally be performed by the loader) itself. The goal of unpacking is to remove the protections from the binary, including the missing import information. So the analyst (or unpacking tool) must determine the collection of imports that the packer loads for the executable, and re-create metadata within the unpacked executable's image that will cause the operating system to properly load the imports as usual.

Typically in these situations, the analyst will determine where within the executable's memory image the import information resides. In particular, the analyst will usually locate the IMAGE_THUNK_DATA arrays, which are NULL-terminated arrays that contain the addresses of imported symbols. Then, the analyst will run a tool that basically performs the inverse of GetProcAddress: given one of these pointers to imported symbols, it will determine in which DLL the pointer resides, and which specific exported entry is referred to by the pointer. So for example, we might resolve 0x76AE3F3C to Kernel32!CreateFileW. Now we use this textual information to recreate IMAGE_IMPORT_DESCRIPTOR structures describing each imported DLL, use the original addresses of the IMAGE_THUNK_DATA arrays, store the names of the DLLs and imported symbols somewhere in the binary (perhaps in a new section), and point the IMAGE_THUNK_DATA entries to those new names.

ImpRec is a popular tool that automates most or all of this process, depending upon the packer. What I just described is reflective of reality in about 95% of cases. More serious protections such as video game copy protections and tricky custom malware use further tricks that stymie the reconstruction process.