|
hi Nacho_dj
i used imprec with no success. it create wrong IAT.
i can found the correct address for each IAT cell by setting a bp on the end of YYYYYYYY function. but i want to correct IAT automatically. i patched the YYYYYYYY function to correct the related IAT cell in each call. but it is not enough. because i can not sure that all of api used when i run the program.
i wrote a script that inject a call for each cell of IAT and execute it. so this script can found an api address for each cell but the result of YYYYYYY function is depend of the caller function. so the result from injection is not true.
so in any of this approach i can not correct IAT. this is my problem.
|