FThunks when trying to get IAT

Question

Pretty new to RE so sorry if this is a dumb question.

I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the dumped .exe I get some invalid/missing results, and I couldn't find any information on how to determine the correct function to assign. I tried running the tool Universal Import Fixer, which seems to fix all the invalid imports but I would be unable to fix my dumped file. Any help would be appreciated!

Here is a screenshot of what I see:

Answer 1

the pointer you are pointing to in your screen shot contains ascii strings

do the app use some dll like BCMenu or Windows Classic Theme etc

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000  42 43 4D 65 6E 75 00 00 57 69 6E 64 6F 77 73 20  BCMenu..Windows 
00000010  43 6C 61 73 73 69 63 2E 74 68 65 6D 65           Classic.theme

google says BCMenu is some cool class by one brent that does owner drawn thingamagic in mfc

the original site of brent corkum has gone defunct since 2015 but wayback has got several snapshots

Answer 2

As it said above, 419030 points to some data, not the code. So you may just remove this FThunk.

Answer 3

Look in the disassembly listing, you see lots of OUTS which is a sign of junk generated by trying to disassemble random data/bytes => this thunk at RVA 00013800 should be safe to be "cut thunk".

You could also follow the virtual address (00400000 + 00013800 = 00413800) of this thunk in the Dump pane of OllyDbg with Long -> Address mode or the dump view of x64dbg with Address mode to check the content at that position.