Questions tagged [iat]

Import Address Table are used as a lookup table when the application is calling a function in a different module in Microsoft Windows operating systems.

Filter by
Sorted by
Tagged with
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
4
votes
1answer
93 views

Statically recovering thunks in Windows x86_64 DLL

I just started working my way to reversing Windows binaries and I stumbled upon the Import Address Table. When reversing a particular DLL I encountered many thunk-functions which all supposedly ...
3
votes
2answers
969 views

Using Python CTypes to get to the IAT

I'm trying to get to IAT of a PE file. My plan is eventually overwrite some values so I can hook some stuff to help with unpacking, etc. I'm using this post https://stackoverflow.com/questions/...
3
votes
2answers
121 views

Find the entry point in Interrupt Vector Table ARM9

I'm analyzing the firmware of a device that has the cpu ARM946E-S. It has not a file system, just assembly code and strings. I've disassembled the firmware using ida pro, but I couldn't find the entry ...
2
votes
3answers
1k views

iat errors in rebuilt executable

I have rebuilt the iat table of a UPX packed to the point where there are no invalid thunks (All "Yes"), I then fix the dump though when I open the final fixed executable in impRec I get invalid ...
2
votes
1answer
69 views

PE - IAT resolve mechanism

I'm trying to understand how Windows is resolving functions with the IAT. I have noticed that when a call is made to a Win API function, the structure of that call is not always the same (it's still ...
2
votes
1answer
2k views

kernel32.BaseThreadInitThunk without IAT

On starting notepad.exe with Ollydbg, I see that eax has a value that points at kernel32.BaseThreadInitThunk. notepad.exe does not seem to import kernel32.dll::BaseThreadInitThunk. I cannot find that ...
2
votes
1answer
176 views

Application crashes after IAT address change

I have an old piece of software (for cutting and plotting vectors onto physical media) (released about 2000-2001) which I use to this day. The software employs a HASP HL with a parallel port hardware ...
2
votes
1answer
763 views

How do I call a statically imported function from a Dll? call dword ptr ds <> not working

Disclaimer: I am relatively new to this whole RE thing. So I successfully crammed some instructions into the end of an existing DLL and redirected a call. Now I actually want to do things with a ...
1
vote
2answers
476 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
1
vote
1answer
108 views

List late binding functions

I'd like to identify all late-binding calls made by a windows 32 or 64 executable program. I can take a look at the imported functions through the IAT but I'm unable to list the functions called ...
1
vote
2answers
2k views

Statically detect destroyed Import Segment (IAT)

I'm writing a tool, which analyses PE-Malformations and I'would like to build a function to detect a destroyed import section in a PE-File. It would be great if it would be possible to somehow figure ...
1
vote
1answer
961 views

ImpRec invalid thunks seem valid

I have been rebuilding the IAT for an executable and have used ImpRec though some of the thunks are showing up as invalid even though on the apparent they show the rva, mod, ord and name fields just ...
1
vote
3answers
1k views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
1
vote
1answer
48 views

Import Address Table in Process Hollowing

I know that the PE loader is the one that is responsible for assigning addresses in a PE Import Address Table, so why when we inject code using process hollowing we don't build the IAT? We just copy ...
1
vote
1answer
540 views

ImpRec invalid NtdllDefWindowProc_A seem valid

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk. Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A ...
1
vote
1answer
102 views

Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?

I want to implement a full blown import reconstructor into my app without any external dll's or Shell Executes to EXEs. I want to just have the ability to get IAT Import addresses to certain imported ...
0
votes
1answer
3k views

what is IAT? and how to find the end of the IAT in packed exe?

I recently started to study RE in my free time. I started to look at lena151 free tutorials and now I'm on packers/protectors. Now i reached to the part that he show how to manually find the end of ...
0
votes
1answer
395 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
0
votes
1answer
364 views

Getting Xrefs to Windows Library Functions in IDA Pro

Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
0
votes
2answers
70 views

Using IAT Hooking to hook end of function

Is it possible? Maybe you can explain it with a simple example if that's possible?