Questions tagged [import-reconstruction]

Import reconstruction is a complementary process to unpacking, usually performed after an executable is unpacked and dumped in order to make it fully functional and executable on it's own. Most packed executable files lack their full import table, requiring imports to be manually reconstructed following the dumping process.

5 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
271 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
2
votes
0answers
39 views

Is there a way to view the complete “Additional Information” log of Ghidra's “Import Results Summary”?

I'm currently trying to look into Q.U.B.E. 2's internal mechanics, so I decided to look at it using Ghidra. Q.U.B.E. 2 is built upon UnrealEngine, so it it's pretty big (~50 Mb's). However, when ...
2
votes
0answers
157 views

For some reason Ghidra SRE cannot determine some imports

After loading the Windows PE executable into Ghidra SRE, some functions imported from MFC90U.DLL Ghidra does not detect: DAT_00aea270 FUN_004ae180:004ae1ee, ...
1
vote
1answer
49 views

Problems with relocation when unpacking

I'm trying to learn how to do basic unpacking EXEs. I've read into how the PE header works, sections, the IAT and I already know a fair bit about assembly. I started with compressing my simple x64....
0
votes
0answers
41 views

How get user32.dll import working from import reconstruction?

I've tried all Import Reconstructors  UIF (this one finds alot of imports but not helpful). Scylla ImpRec Imports Fixer 1.6 CHImpREC None of them can get me user32.dll import correctly from my ...