0

I have unpacked and dumped a dll that uses a custom IAT to resolve Win32 API calls (143 of them). Is there anyway to modify the dumped dll PE to include these imports dynamcially and forward their addresses to the dumped function pointer table.

See below a photo of the on disk dumped PE function table and the list of functions

enter image description here

  • Why do you want to resolve the imports dynamically and not just modify the IAT inside the dumped file? – morsisko May 24 at 16:44
  • I rebuilt the IAT inside scylla however these imports where not detected. I don't know how to point the imports to this table correctly, it's also an x64 pe so i cant use lordpe – rob-DEV May 24 at 16:59
  • what's your end goal? make unpacked exe runnable or simply analyze the code? – Igor Skochinsky May 24 at 22:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.