small problem with ImpRec

		Exetools > General > General Discussion
small problem with ImpRec

07-10-2008, 23:44

Hero

VIP

Join Date: Jan 2005

Posts: 226

Rept. Given: 2

Rept. Rcvd 1 Time in 1 Post

Thanks Given: 5

Thanks Rcvd at 2 Times in 2 Posts

Hi Nacho
There is no problem in running dumped_fixed.exe on my computer,and this,itself is a problem...

I assume that addresses you told me are RVA-Base,if so yes,FirstThunk of App is at address 0x95EA90,But FirstThink should be 0x57d000, not 0x95EA90.
I were about to rebuild FirsthThunks at 0x57d000, but ImpRec create new IAT and i got FirsthThunks at 0x95EA90.
I didn't notice this at first too,But if you decompile dumped_fixed.exe,you will see that there is no reference to FirstThunks at address 0x95EA90.

Regards

__________________
I should look out my posts,or JMI gets mad on me!

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Switch to Linear Mode Switch to Hybrid Mode Threaded Mode

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
ImpRec bug ?!!	Newbie_Cracker	General Discussion	2	11-14-2006 21:06
Problems with Imprec 1.6f >	ILCH	General Discussion	6	11-18-2004 09:16
ImpREC.dll & reversing	FEUERRADER	General Discussion	0	02-17-2004 22:41
imprec question	fotisl	General Discussion	1	09-20-2002 06:09

All times are GMT +8. The time now is 22:45.