0

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed.

I'm reverse engineering a packed win32 executable, so I dumped it with Scylla. My understanding is that typically, one of the first things you do is rebuild the IAT. However, this executable seems to differ in that the majority of the calls don't reference an IAT, example:

enter image description here

I am having trouble with what to do in this scenario to get pretty names for all of these calls. I found something like an IAT with a massive array of import function symbols and wrote a script that prints out a large list of (address, symbol name) pairs, but then I can't figure out how to input this information into IDA (IDAPython set_name fails as it is not an allocated address).

Could I have general advice on what to do here? (some way to tell IDA a DLL loads somewhere and it gets symbols, somehow define my list of symbols despite IDA not knowing about the memory, etc.) I suspect I am missing something really simple since the fact that I'm able to generate my list means I have the information, just not how to input it!

6
  • Did you try using the Scylla IAT rebuilder ? After making your dump, hit the "IAT Autosearch" button then "Get Imports". Then click "Fix Dump", import your previous dump, and you should be good. Your fixed dumped should have been named "<original-name>_SCY"
    – Guillaume
    Jul 21 at 10:53
  • I tried that, and it failed, and I found something that made it say that it worked, but the re-exported executable doesn't have correct imports still. But, so, you are saying that even though these aren't calling a pointer like an IAT, fixing the IAT will allow IDA to resolve all the calls? Jul 21 at 20:54
  • It should, yes. Have you tried to see if your dump is properly aligned ('unmapped' format: check the Virtual Address of the sections and the Raw vs Virtual size of them). Maybe your IAT is properly construct in the dump, but since this is not aligned, the calls are not pointing on the import table anymore, and that's why IDA does not resolve anything. You can also try to use the unpac[.]me automatic unpacker service. If it works, it should give you something to compare your dump against.
    – Guillaume
    Jul 22 at 7:36
  • Hmm... thanks for the ideas, my initial thought to alignment is it can't be an issue due to no ASLR but maybe I'm wrong. This is a Themida-packed app, so it could be I'm just using the wrong IAT base and unpac.me doesn't support Themida so that makes things trickier. Jul 22 at 20:49
  • Sorry to say that, but maybe you should put this binary somewhere, and retry later when you'll be more confident with unpacking. Themida is a pain to unpack even for professional reverse-engineer. This is not appropriate for a first IAT rebuild. Themida break down the IAT in small subsets, and only use the needed portion. So you CAN'T find a proper IAT that is fully functional with your dump. And even if you somehow restore the IAT, Themida make use of a virtual machine to run the code, so you'll have to reverse the virtual machine, convert the instruction set then write a devirtualizer.
    – Guillaume
    Jul 23 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.