Thread: VB Unpacking
View Single Post
  #3  
Old 02-20-2005, 03:37
crkelbery
 
Posts: n/a
"I tried import rebuilding usinfg ImpRec but without any success"

it sounds like one of these recent packers who put IAT in a memory place away from the executable sections. You dump it.....but some calls are refering to a distant place in memory (call [13xxxxxx], not to an adress inside the exe (call [40xxxx]). Imprec isn't able to solve this. If this is the case, you should fool the packer and force it to call [someplaceinsidetheexe].
Some aspr 2.0 have been unpacked using this technique....
(sorry for my english)
Reply With Quote