I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping enter image description here

  • Welcome to RE.SE! If this is part of an unpacking effort it may be a bit more complicated than what you seem to be expecting. Providing more information in your question may be helpful here. – NirIzr Jan 19 '20 at 17:10

I used Explorer Suite for patching IAT.

  • While this may answer the question, it's a bit thin on the details. It would be nice if you could flesh that out a bit, for example with a screenshot showing what to change where ... – 0xC0000022L May 18 '20 at 19:21
  • To be honest, it seems I was wrong when answered the question. I used Explorer Suite for adding new libs and changing addresses of some functions. At the same time, the question implies restoring the original Import Table after deobfuscation. – slinkin May 19 '20 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.