0

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their addresses to the dumped function pointer table.

See below a photo of the on disk dumped PE function table and the list of functions

enter image description here

3
  • Why do you want to resolve the imports dynamically and not just modify the IAT inside the dumped file?
    – morsisko
    May 24 '20 at 16:44
  • I rebuilt the IAT inside scylla however these imports where not detected. I don't know how to point the imports to this table correctly, it's also an x64 pe so i cant use lordpe
    – rob-DEV
    May 24 '20 at 16:59
  • what's your end goal? make unpacked exe runnable or simply analyze the code?
    – Igor Skochinsky
    May 24 '20 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.