1

I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just like the valid thunks.

Should I just delete the thunks which are highlighted as invalid or do further analysis and if so how ?

enter image description here

3
  • It could be because Import REConstructor detected thunks for 2 different DLLs without a 0x00000000 separator entry between the thunks. Could you please post a screenshot? Aug 28 '14 at 22:36
  • No it's not that I checked in OllyDbg
    – user28130
    Aug 28 '14 at 22:50
  • Yes, it's exactly that. Your screenshot confirms it :) See my answer below @ reverseengineering.stackexchange.com/a/6135/1562 Aug 29 '14 at 2:47
3

Import REConstructor detected thunks for 2 different DLLs (combase.dll and ole32.dll) without a 0x00000000 separator entry between the thunks. This is because one of these DLLs (ole32.dll) exports functions that are forwarded to the other DLL (combase.dll).

Import REConstructor needs all adjacent thunks (without a 0x00000000 in between them) to be from the same DLL, so to fix this problem, you'll need to double-click on each of those combase.dll thunks and specify the forwarding function from ole32.dll.

For example, double-click on the combase.dll!CLSIDFromString entry and tell Import REConstructor that its Import Table entry should actually be ole32.dll!CLSIDFromString, then double-click on the combase.dll!CLSIDFromProgID entry and tell Import REConstructor that its Import Table entry should actually be ole32.dll!CLSIDFromProgID, then the same for CoTaskMemFree, CreateStreamOnHGlobal, etc. Note that you'll need to do this for all combase.dll thunks in this block, not just the ones that are currently highlighted as invalid.

2
  • It works though what should I do in the case of user32.dll which has one function forwarded to another dll, it would be tedious to manually change the 162 other functions in user32.dll, is there no other way around this?
    – user28130
    Aug 29 '14 at 14:24
  • @user28130 what was your solution for this problem?
    – the_endian
    Nov 22 '17 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.