View Single Post
  #1  
Old 01-12-2005, 08:52
OrionOnion
 
Posts: n/a
I did unpacking app like your case.

my case was Starforce. (3 years ago.. hugh~~)

SF used emulating of Kernel,GDI,User process.

first I dumped code section, & alpha.dll (It emulate imported function)

and I checked all opcode pointed on alpha.dll in code section.

like call alpha.xxxx
jmp alpha.xxxx
mov reg32,alpha.xxxx

I gathering all opcode address & referece address point.
and I made new IAT by gathered information.

gathering is so Hard or not.

If you want find Making Import table, Check hxxp://win32asm.cjb.net <Iczelion's Win32 Assembly Homepage>

There good information about PE File format.
Reply With Quote