|
Are you able to dump/rebuild the app (so it run on that system) on both systems? If so, try to do it and compare the results - then you'll see the difference.
By the way, if I remember right, UPXed programs used to have the copies of original PE header inside (after unpack), so maybee try to look inside, if there is also import/reloc section. If so, it should be quite easy to rebuild the proggie.
Also try to look for some api monitor, I'm quite sure that UPX uses normal loadLibrary/getProcAdress functions so it could give you clue, if rebuilt import table is correct.
If nothing else helps, I could try to look at it; I can't promise anything, but if I have some time, maybee I could help.
Regards
least
|