I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
-
Welcome to RE.SE! If this is part of an unpacking effort it may be a bit more complicated than what you seem to be expecting. Providing more information in your question may be helpful here.– NirIzrJan 19, 2020 at 17:10
Add a comment
|
1 Answer
I used Explorer Suite for patching IAT.
-
While this may answer the question, it's a bit thin on the details. It would be nice if you could flesh that out a bit, for example with a screenshot showing what to change where ...– 0xC0000022L ♦May 18, 2020 at 19:21
-
To be honest, it seems I was wrong when answered the question. I used Explorer Suite for adding new libs and changing addresses of some functions. At the same time, the question implies restoring the original Import Table after deobfuscation.– slinkinMay 19, 2020 at 8:23