|
I did unpacking app like your case.
my case was Starforce. (3 years ago.. hugh~~)
SF used emulating of Kernel,GDI,User process.
first I dumped code section, & alpha.dll (It emulate imported function)
and I checked all opcode pointed on alpha.dll in code section.
like call alpha.xxxx
jmp alpha.xxxx
mov reg32,alpha.xxxx
I gathering all opcode address & referece address point.
and I made new IAT by gathered information.
gathering is so Hard or not.
If you want find Making Import table, Check hxxp://win32asm.cjb.net <Iczelion's Win32 Assembly Homepage>
There good information about PE File format.
|