Questions tagged [import-reconstruction]
Import reconstruction is a complementary process to unpacking, usually performed after an executable is unpacked and dumped in order to make it fully functional and executable on it's own. Most packed executable files lack their full import table, requiring imports to be manually reconstructed following the dumping process.
17
questions
0
votes
0
answers
70
views
Pe file import binding
I'm learning a bit about PE files. The thing I've struggling a bit now it the First Thunk and Original First Thunk fields. To understand the difference between them I've read this post and that ...
- 115
3
votes
1
answer
2k
views
Rebuild IAT after manually unpacking DLL
I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP.
But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
- 235
3
votes
0
answers
664
views
Is there a way to view the complete "Additional Information" log of Ghidra's "Import Results Summary"?
I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
- 131
1
vote
1
answer
191
views
Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?
I want to implement a full blown import reconstructor into my app without any external dll's or Shell Executes to EXEs. I want to just have the ability to get IAT Import addresses to certain imported ...
- 759
1
vote
3
answers
1k
views
Problems with relocation when unpacking
I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly.
I started with compressing my simple x64....
- 11
3
votes
0
answers
1k
views
For some reason Ghidra SRE cannot determine some imports
After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect:
DAT_00aea270 FUN_004ae180:004ae1ee,
...
2
votes
1
answer
2k
views
What does Scylla/ImpRec are doing? How to reconstruct imports?
Mostly in the tutorials they are telling to use this tool and that tool to magically apply something and make XY work & run. I would love to know how these things are working, how is import ...
- 23
1
vote
3
answers
3k
views
FThunks when trying to get IAT
Pretty new to RE so sorry if this is a dumb question.
I'm trying to manually unpack an executable and I believe I've found the OEP. However, when I use Scylla to try to fix the import table of the ...
0
votes
1
answer
808
views
How to build a 32-bit DLL in pure assembly
This is the code I've managed to build so far to implement DLLSkeleton.dll:
http://archive.org/download/lowlevelDLL32_try0000/x86_WinAPI_ASM_PE_EXE_Skeleton32--v2017-07-26.zip
I'm trying to make a ...
- 111
5
votes
2
answers
3k
views
Why to dump precisely at OEP while manual unpacking?
What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer.
This Link says:
In order to identify the IAT structure, Import Reconstructor ...
- 218
3
votes
2
answers
5k
views
Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error
I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried.
Modified the flag in its PE header so that windows loads the ...
- 303
3
votes
1
answer
342
views
iOS Obfuscated Import Table
I'm looking at an Apple iOS binary file which is heavily protected and I trying to figure out if there's a way to get some of the information back.
When I open the binary in IDA I see this in the ...
- 201
3
votes
0
answers
302
views
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
- 31
0
votes
1
answer
516
views
Why is IAT filled with static addresses instead of function names?
When a program is packed the OriginalFirstThunk tends to be discarded. When the loader resolves the imports, then how does it know which functions to look for? For some reason the IAT (FirstThunk) is ...
- 57
1
vote
2
answers
621
views
Why isn't the import table ready at OEP?
When manually unpacking a program and ending up at the OEP, then why do we have to rebuild the import table? I understand that when packing, the import table is destroyed for compression/stealth, but ...
- 57
12
votes
1
answer
1k
views
What is import reconstruction and why is it necessary?
When reading about unpacking, I sometimes see an "import reconstruction" step. What is this and why is it necessary?
- 1,537
19
votes
3
answers
15k
views
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
- 10.9k