Questions tagged [iat]

Import Address Table are used as a lookup table when the application is calling a function in a different module in Microsoft Windows operating systems.

Filter by
Sorted by
Tagged with
1
vote
2answers
612 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
0
votes
1answer
235 views

Getting Xrefs to Windows Library Functions in IDA Pro

Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
2
votes
1answer
387 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
1
vote
2answers
2k views

Statically detect destroyed Import Segment (IAT)

I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
1
vote
1answer
416 views

ImpRec invalid NtdllDefWindowProc_A seem valid

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk. Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
0
votes
1answer
2k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
0
votes
1answer
324 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
1
vote
2answers
426 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
2
votes
3answers
1k views

iat errors in rebuilt executable

I have rebuilt the iat table of a UPX packed to the point where there are no invalid thunks (All "Yes"), I then fix the dump though when I open the final fixed executable in impRec I get invalid ...
1
vote
1answer
106 views

List late binding functions

I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
1
vote
1answer
816 views

ImpRec invalid thunks seem valid

I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
2
votes
1answer
2k views

kernel32.BaseThreadInitThunk without IAT

On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk. notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk. I cannot find that ...
2
votes
1answer
155 views

Application crashes after IAT address change

I have an old piece of software (for cutting and plotting vectors onto physical media) (released about 2000-2001) which I use to this day. The software employs a HASP HL with a parallel port hardware ...
3
votes
2answers
898 views

Using Python CTypes to get to the IAT

I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/...