I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just like the valid thunks.
Should I just delete the thunks which are highlighted as invalid or do further analysis and if so how ?
Import REConstructor detected thunks for 2 different DLLs (combase.dll and ole32.dll) without a 0x00000000 separator entry between the thunks. This is because one of these DLLs (ole32.dll) exports functions that are forwarded to the other DLL (combase.dll).
Import REConstructor needs all adjacent thunks (without a 0x00000000 in between them) to be from the same DLL, so to fix this problem, you'll need to double-click on each of those combase.dll thunks and specify the forwarding function from ole32.dll.
For example, double-click on the combase.dll!CLSIDFromString entry and tell Import REConstructor that its Import Table entry should actually be ole32.dll!CLSIDFromString, then double-click on the combase.dll!CLSIDFromProgID entry and tell Import REConstructor that its Import Table entry should actually be ole32.dll!CLSIDFromProgID, then the same for CoTaskMemFree, CreateStreamOnHGlobal, etc. Note that you'll need to do this for all combase.dll thunks in this block, not just the ones that are currently highlighted as invalid.
