I have a packed program. I have found the oep of the program but the problem is every call to the system dll like kernel32, user32, ... change to a call to the heap. So the packer first allocate a big chunk of heap, copy the dll function to the heap and then instead of the call to dll it call the heap.

So my question is is there anyway to dump the heap to section? if not then how can i fix the iat in this situation?

Edit: After some experiments, i found that it use asprotect to pack. The iat got obfuscate, instead of call to the function it call to the heap and then the heap will jump to another heap which contain a part of the function and then jump to the real function. So the problem now boil down to how can i fix the iat for it to run? I did set hardware breakpoint on the time the iat create but the function doesn't get written in the iat

  • Is your purpose obtaining fully working unpacked executable or just a dump with all imports labeled properly so you are able to analyse program statically?
    – bart1e
    Commented Dec 16, 2020 at 17:30
  • @bart1e i want the executable to fully function. I have updated the question
    – haxerl
    Commented Dec 18, 2020 at 3:44


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.