3

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.

  1. Modified the flag in its PE header so that windows loads the file as an exe, not a dll.
  2. Loaded to Immunity Debugger and found the real entry point(Entry point of unpacked binary)
  3. Dumped the the binary at this entry point.
  4. Now I opened ImpREC to fix the import table of the of the dumped DLL. However, in ImpREC the base memory displayed is 7100000. When I give "068BA2A0" as entry point, ImpRec complaints invalid OEP!. I dont understand how the base address of the debugged process is "7100000". I suspect this could be the problem.

enter image description here

Why is this error? Any pointers to fix it?

1

Your analysis machine is Windows 7, ASLR is modifying your module base addresses between different executions.

Try calculating the offset to your OEP (that is, address - base) and using this value to calculate OEP address with the new base (base2 + offset)

  • I just tried it with XP machine and it worked. Thank you. – aMa Mar 28 '15 at 22:26
  • However, it didn't work with windows 7. I tried to keep EOP as 7100000 (base address found by ImpREC) + BA2A0 (offset found in immunity) = 071BA2A0. Still same error. – aMa Mar 28 '15 at 22:29
  • I am again getting same error on XP. This is so weird. How do I find the the new base address, if the problem is ASLR? – aMa Apr 17 '15 at 6:29
1

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options :

  • 1 - Untick it in options and reselect your target
  • 2 - Use a custom PE header with Advanced commands / Load PE Header

-> First choice is the best for your case.

Explaination : the reason "Use PE Header From Disk" is enabled by default, comes from protector which destroys the header in memory so it's best to rely on disk but it's bad for DLL.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.