thanks nacho_dj and nskSem,
i am coding a new pe packer(once again), and found this problem packing the own packer´s .exe, compiled with msvc .net 2003
i am kinda ashamed of not knowing this, as i play with pe files at long time: i always thought that import forwarding has to do with the ForwarderChain field in iat dir
as i never found a sample of this (as i used w9x till few time ago), i just thought that the whole dll was forwarded, and that in ForwarderChain field was the dll base address
i think i can resolve this doing something like this:
Code:
if((api_address>pe->exportbase)&&(api_address<(pe->exportbase+pe->exportsize)))
api_address=getproc_by_hash(api_address,hash(api_address+strpos(api_address,".")));
thanks for the help, guys
ancev