Mostly in the tutorials they are telling to use this tool and that tool to magically apply something and make XY work & run. I would love to know how these things are working, how is import reconstruction done generally?
For example in my case I would need dump a malware from memory, where it's manual mapped, but these import reconstruction tools usually does not support such a thing, this is why I want to learn what it is at all. (I know that there are workarounds how to make them work, but I want to know the logic behind imp reccing)
So, back to the question. Are they analyzing the code itself for calls which are residing in external modules? Or are they using some other/existing/runtime table which usually unveil the original modules/procs.
I couldn't find any good docs/description about it (except for whole the codebase of Scylla)