I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
-
Welcome to RE.SE! If this is part of an unpacking effort it may be a bit more complicated than what you seem to be expecting. Providing more information in your question may be helpful here. – NirIzr Jan 19 '20 at 17:10
Add a comment
|
I used Explorer Suite for patching IAT.
-
While this may answer the question, it's a bit thin on the details. It would be nice if you could flesh that out a bit, for example with a screenshot showing what to change where ... – 0xC0000022L♦ May 18 '20 at 19:21
-
To be honest, it seems I was wrong when answered the question. I used Explorer Suite for adding new libs and changing addresses of some functions. At the same time, the question implies restoring the original Import Table after deobfuscation. – slinkin May 19 '20 at 8:23
