Skip to main content
6 votes
Accepted

Why to dump precisely at OEP while manual unpacking?

But how does knowing OEP relate to IAT? OEP does not relate to the IAT, but is used by import reconstruction tools to find the location of IAT-like structures created by the packer. When ...
NirIzr's user avatar
  • 11.8k
4 votes

Why to dump precisely at OEP while manual unpacking?

I think there is something mixed up here. But how does knowing OEP relate to IAT? It does not (for benign software). However, the article you linked analyzes a packed executable. Often, malware ...
Nordwald's user avatar
  • 2,906
3 votes
Accepted

What does Scylla/ImpRec are doing? How to reconstruct imports?

Different import reconstruction tools employ different heuristics in order to find the method used by the malware/packer because manually implemented import tables can be achieved in multiple ...
NirIzr's user avatar
  • 11.8k
2 votes

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I think this is too late but let's reply though. By default ImpREC has "Use PE Header From Disk" enabled. Which means it will NOT use the relocated DLL imagebase. 2 options : 1 - Untick it in options ...
Dessloch's user avatar
2 votes

Problems with relocation when unpacking

i found a tool for unpacking UPX x64.exe it work for me. it is called XVolkolak v0.22 i found it here: http://ntinfo.biz/index.html its a universal tool so it can unpack other packers to. Good luck. ...
Luffe's user avatar
  • 21
2 votes
Accepted

Rebuild IAT after manually unpacking DLL

I solved this by manually fixing each missing import API. First I did a text dump of the unpacked dll using BinText where I found a list of imported API's. I then compared it to the list of API ...
majidarif's user avatar
  • 235
1 vote
Accepted

Import Reconstruction in runtime library? any open source ones or any import reconstructors source codes?

Here is my final code.. it works.. gets all imports except a missing a few like 10 at most.. which are hardly important anyways. It misses GetCurrentProcessId(),GetCurrentProcess(),LoadLibrary. It ...
SSpoke's user avatar
  • 759
1 vote

Problems with relocation when unpacking

AFAIK there is no existing tool but you should be able to create one using the approach used by DOS unpackers: Run the binary once, dump it at the entry point Run it second time, forcing the load ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

FThunks when trying to get IAT

Look in the disassembly listing, you see lots of OUTS which is a sign of junk generated by trying to disassemble random data/bytes => this thunk at RVA 00013800 should be safe to be "cut thunk&...
Minh-Triet Pham Tran's user avatar
1 vote

FThunks when trying to get IAT

As it said above, 419030 points to some data, not the code. So you may just remove this FThunk.
Anton Kukoba's user avatar
  • 1,850
1 vote

FThunks when trying to get IAT

the pointer you are pointing to in your screen shot contains ascii strings do the app use some dll like BCMenu or Windows Classic Theme etc Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E ...
blabb's user avatar
  • 16.4k
1 vote

How to build a 32-bit DLL in pure assembly

I have managed to implement a first attempt of a DLL, a DLL called WinAPI32.dll intended to import the entirety of the standard WinAPI and MSVC library from Windows 9x to Windows 10, and then export ...
Sam V's user avatar
  • 111

Only top scored, non community-wiki answers of a minimum length are eligible