0

The find command in x64dbg(x86),
(found here: https://help.x64dbg.com/en/latest/commands/searching/find.html) doesn't return anything. For example:
findall 0x00524180, "E8 ????????" returns 50 occurences
BUT
find 0x00524180, "E8 ????????" doesn't return anything.
However, when I write a false adress, or a wrong pattern, it returns an error.. For my goal, I want to restore the IAT of a program, which fools Scylla doing that: changing absolute import calls to Relative ones (FF 15 funcAdress -> 90 E8 func2Adress). enter image description here

We can see why i wrote func2Adress, a sort of code is added which lead to the import function. For example, if I follow the call in adress 0x5950A82, I find many JMP instructions and other relative calls + some "Junk instructions" before the call of the import function. in the end to the import function. enter image description here So what I'm trying to do is to use the x64dbg commands to replace each relative call with it's correct import function adress (absolute call) so that I can use Scylla to find IAT, but here I can't even use the find command, so I don't know if it's the best way to proceed. Any idea? For info, the program is packed by Thermida. Thank you!

  • EDIT: I've found a solution for the find problem; findall results can be seen in References view of x64dbg. I've also managed to find a way to edit adresses: edit the hex dump by c# for example. But still there's one problem: import the new hex section (60Mo!). I can edit that in the hex view, but it seems that there is no "Select All". Is there a way to do that? – Xyt Feb 21 at 3:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.