Import OS Fixing

huh?
if you are seeking COMFORT, than big sorriE!

1. you need do this comparision if only you are going to share your workz;
2. also there is old future for w9x, called import Renormalizing.. can be usefull;
(but some prots can detect it)

[MaRKuS-DJM]

i'm not searching comfort, but i thought there would be a easier way to get OriginalFirstThunk. for very much targets i did inline-patching, but i've never seen a inline-patch for Asprotect 1.23. but as i see, ASPR-Stripper is able to fix the imports for every OS without any problems

mostly i think, aspr-stripper not resolves imports but grabs them from aspr;
so all is ok;


>OriginalFirstThunk
?? you are messing something..

[MaRKuS-DJM]

OriginalFirstThunk
i think it should fix the problem?

maybe i should read some tutorials for Import Table... do you know a good one?
PS: i found some description how to fix for every OS in safedisc... it's a very long article, but maybe it helps

[Jay]

If I remember correctly Lunar_Dust released a First_Thunk_Rebuilder, never had occasion to use it so I don't know if will help you with your problem, may be worth checking out.

[MaRKuS-DJM]

Originally Posted by Jay

If I remember correctly Lunar_Dust released a First_Thunk_Rebuilder, never had occasion to use it so I don't know if will help you with your problem, may be worth checking out.

i think it's worth a try thanks you!

EDIT: i see this tool does exactly the same as the option in imprec "Rebuild Original FT"
i wasn't able to test it if it works (till now)

PS: does it make sense to import by ordinal?

[britedream]

Hi
400000+3c---> offset to pe signature, add to whatever there 80H, then there is an RVA to IMPORTDirectory.

regards.

Markus, that unpacked PEC on ftp are your?

[britedream]

Originally Posted by MaRKuS-DJM

i'm not searching comfort, but i thought there would be a easier way to get OriginalFirstThunk.

Hi ,
I am only responding to your quotation above, I don't have the target.but after adding 80h, you will have VA, at this Va , there is Rva pointing to importDirectory, where you can find the OriginalFirstThunk you are looking for.

[MaRKuS-DJM]

Originally Posted by britedream

Hi ,
I am only responding to your quotation above, I don't have the target.but after adding 80h, you will have VA, at this Va , there is Rva pointing to importDirectory, where you can find the OriginalFirstThunk you are looking for.

oh thanks it looks interesting... i'll see what i can do with it

ok, in 2.09 ver Pec2Gui bugs are fixed; congratz author;
some import-related bug presents again.