So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)

i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one from there, and the IAT search was successful

but the problem is after dumping it and loading it in IDA so i can use the decompiler, the API calls are like MEMORY[address](a , b . c)

i couldn't use the IDA to debug it because it gave some error before reaching WriteProcessMemory, i guess some anti debugging stuff, even with scyllahide i couldn't bypass these errors, but weirdly enough x32dbg had no problems, errors are because of wrong memory access, but somehow x32dbg has no problem!

so how can i fix this? i checked the addresses in MEMORY[address] and they are in fact the address of API calls, but i guess since the program is using them directly and not via IAT then IDA cannot know what are they, i guess one fix would be somehow including those dlls in their exact address in the dumped PE but i dont know how

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.