Exetools - View Single Post

#4 03-31-2005, 22:59

Code:

resolve_import:
                mov     esi, 2054h     [bold] ;; import tbl rva[/bold]
                mov     edx, ss:(h_instance - unk_406013)[ebp]
                add     esi, edx

process_library:
                mov     eax, [esi+_IMAGE_IMPORT_DESCRIPTOR.Name]
                test    eax, eax
                jz      imp_tbl_done
                add     eax, edx

Here You can dump unpacked program before aspack's loader fill original import table with functions.