I've unpacked a binary which was packed with PECompact v2.2 (according to Detect It Easy) and successfully rebuilt the IAT. The binary actually does run, but when I open it in IDA Pro debugger, it is making calls to memory which isn't in existence in the process, which prevents the program from continuing to execute and presents an error (shown below) in IDA. I've also attempted to debug this same program in OllyDbg but OllyDbg doesn't seem to even parse the instructions inn the unpacked version. My question is, what could cause this? Did I unpack the file wrong? Fail to properly rebuild the IAT? Is this a rebasing issue? How can I fix this?

It should also be noted that I try to apply the offset to the proper image base but still, it does not exist:

Here can see the calls; these calls point to memory not inside this process.

This is the error message given by IDA Pro X32Dbg also shows the invalid CE calls

This shows theres no data section in the file, but the imports are intact

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.