Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

Question

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
3. Dumped the the binary at this entry point.
4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give "068BA2A0" as entry point, ImpRec complaints invalid OEP!. I dont understand how the base address of the debugged process is "7100000". I suspect this could be the problem.

Why is this error? Any pointers to fix it?

Answer 1

Your analysis machine is Windows 7, ASLR is modifying your module base addresses between different executions.

Try calculating the offset to your OEP (that is, address - base) and using this value to calculate OEP address with the new base (base2 + offset)

Answer 2

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options :

• 1 - Untick it in options and reselect your target
• 2 - Use a custom PE header with Advanced commands / Load PE Header

-> First choice is the best for your case.

Explaination : the reason "Use PE Header From Disk" is enabled by default, comes from protector which destroys the header in memory so it's best to rely on disk but it's bad for DLL.