All Questions

Filter by
Sorted by
Tagged with
1
vote
2answers
620 views

FThunks when trying to get IAT

Pretty new to RE so sorry if this is a dumb question. I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
0
votes
1answer
326 views

Why is IAT filled with static addresses instead of function names?

When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
1
vote
2answers
427 views

Why isn't the import table ready at OEP?

When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...