Hot answers tagged


I solved this by manually fixing each missing import API. First I did a text dump of the unpacked dll using BinText where I found a list of imported API's. I then compared it to the list of API detected by ImpRec and I noticed that the calls are in the same order on the text dump. So I just double clicked the line of the invalid import on ImpRec and ...


Looks like it's just addition for the checksum, so nice job on that. The mystery byte is part of the checksum. The accumulator is 2 bytes. data = """0000AAAAAA7E00201075000000075FC76F4F0105C8 0000AAAAAA7E00201075000000875FC77BED210712 0000AAAAAA7E00201075000000885FC77BFF010705""".strip().split("\n") import struct for ...


Two options: Include the targets of the pointers into the snapshot (can be done by enabling the target segment’s loader flag in segment properties, or via “Analyze module” from the Modules context menu) Rename the import table pointers using the pointed-to names (e.g. using renimp.idc or similar script)

Only top voted, non community-wiki answers of a minimum length are eligible