|
No, not IAT, it is IDT: Import Directory Table. ImpREC GUI/document make user confusing about them. The IAT in dump file is always the IAT in the fixed files. ImpREC will only fix the IDT + name table + original table...
I alway use PEView to view the IAT/IDT struct before and after dumping PE file.
The option of ImpREC change the way of IAT/IDT in the fixed file.
Last edited by TQN; 07-07-2008 at 22:41.
|