|
small problem with ImpRec
Hi all
When I were unpacking an application,I find out an strange problem.
My ImpRec gets every imprt correctly,and I can repair my dump with 'add new section' checked with no problem.
But I need to rebuild my current FirstThunks,so I uncheck 'add new section' and set RVA equal to RVA that I found my IAT in it(for example my RVA to 'Get Import' is 57000,I set RVA to fix dump 57000).
When I try to fix dump in his case,ImpRec corrupts my FirstThunks,so PE becomes invalid.
Am I doing something wrong?
Regards
__________________
I should look out my posts,or JMI gets mad on me! 
|