0

Dumped the PE using Scylla, analysing without issues, but when I was trying to inspect codes, I see that IDA analysed imports incorrectly.

It means that I see for example MapViewOfFile(), which according to pseudo does not what it should do, after jump to this imp in .idata I see what this should be GetModuleHandleW() (Fake + 0x18 = real) and this is valid for all imports, OFC, IDA analysed all wrong + undefined variables causes that.

Never seen that issue, maybe somebody knows how to fix.

enter image description here

1 Answer 1

1

This seems more so an issue with the dump you've provided to IDA rather than IDA analyzing the imports wrong. Depending on how you dumped the executable, some fix-ups may be required on imports and the PE header.

1
  • Used program naming as Scylla for dumping, nothing especial. Dump was maked in runtime when PE was unpacked and loaded imports, if check runtime memory imports are ok, this only in dump.
    – John
    Jul 9, 2021 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.