3

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP.

enter image description here

But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it just doesn't work.

enter image description here

Here are the results from ImpREC

enter image description here

My question is, why are there invalid imports detected when the OEP is most likely correct?

Improve this question
2
  • Can you share the dll (packed version)?
    – bart1e
    Dec 30, 2020 at 14:23
  • @bart1e I can but not sure if it's safe to do so.
    – majidarif
    Jan 3, 2021 at 14:33

1 Answer 1

Reset to default
2

I solved this by manually fixing each missing import API.

First I did a text dump of the unpacked dll using BinText where I found a list of imported API's.

enter image description here

I then compared it to the list of API detected by ImpRec and I noticed that the calls are in the same order on the text dump.

enter image description here

So I just double clicked the line of the invalid import on ImpRec and manually input the correct API (based on the order shown on the text dump) as seen here:

enter image description here

I repeated this for every invalid API and fixed the dump and this time it all worked.

To sum it all up from the original question. The OEP was correct. The detected API's were correct. It just needed a little intervention to fix the invalid imports detected.

Thank you!

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.