I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping enter image description here

  • Welcome to RE.SE! If this is part of an unpacking effort it may be a bit more complicated than what you seem to be expecting. Providing more information in your question may be helpful here.
    – NirIzr
    Jan 19, 2020 at 17:10

1 Answer 1


I used Explorer Suite for patching IAT.

  • While this may answer the question, it's a bit thin on the details. It would be nice if you could flesh that out a bit, for example with a screenshot showing what to change where ...
    – 0xC0000022L
    May 18, 2020 at 19:21
  • To be honest, it seems I was wrong when answered the question. I used Explorer Suite for adding new libs and changing addresses of some functions. At the same time, the question implies restoring the original Import Table after deobfuscation.
    – slinkin
    May 19, 2020 at 8:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.