|
"I tried import rebuilding usinfg ImpRec but without any success"
it sounds like one of these recent packers who put IAT in a memory place away from the executable sections. You dump it.....but some calls are refering to a distant place in memory (call [13xxxxxx], not to an adress inside the exe (call [40xxxx]). Imprec isn't able to solve this. If this is the case, you should fool the packer and force it to call [someplaceinsidetheexe].
Some aspr 2.0 have been unpacked using this technique....
(sorry for my english)
|