1

Pretty new to RE so sorry if this is a dumb question.

I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the dumped .exe I get some invalid/missing results, and I couldn't find any information on how to determine the correct function to assign. I tried running the tool Universal Import Fixer, which seems to fix all the invalid imports but I would be unable to fix my dumped file. Any help would be appreciated!

Here is a screenshot of what I see: enter image description here

1

the pointer you are pointing to in your screen shot contains ascii strings

do the app use some dll like BCMenu or Windows Classic Theme etc

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  42 43 4D 65 6E 75 00 00 57 69 6E 64 6F 77 73 20  BCMenu..Windows 
00000010  43 6C 61 73 73 69 63 2E 74 68 65 6D 65           Classic.theme

google says BCMenu is some cool class by one brent that does owner drawn thingamagic in mfc

the original site of brent corkum has gone defunct since 2015 but wayback has got several snapshots

0

As it said above, 419030 points to some data, not the code. So you may just remove this FThunk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.