![]() |
ImpREC.dll & reversing
I want use ImpREC.dll in my unpacker, but it works only on winNT-systems :( HOWEVER, GUW32 use THIS ImpREC.dll and successfully rebuild import on win9x! It's a paradox!!!
In my unpacker ImpREC.dll on win9x import looks like: ============================= KERNEL32.dll 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache KERNEL32.dll 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache ============================= On WinXP my unpacker works fine, but on win9x import filled FlushInstructionCache functions. Rebuild function looks like: BOOL RebuildImport(DWORD pid, DWORD oep_rva, DWORD iat_rva, DWORD nb_recursion, LPTSTR dump_filename); Syntax of my call on MSVC++ 6.0: RebuildImport(pi.dwProcessId, 0x401000, 0, 5, m_Dumpname); What is nb_recursion??? I reversed PEiD Generic Unpacker by Snaker and there found this number. There was 5. What number must be there?? p.s. sorry for my ugly english :) |
| All times are GMT +8. The time now is 21:35. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX