Locate procedure in olly

[copyleft]

maybe you have missed some api during unpacking,...
is IAT completely recovered ? or just used cut Thunk for some API !!?

[yogi_saw]

thanks guys
@congviet there is no such call to the enablemenuitem api app is mfc application which makes many call to mfc42 and i cant find usage of it in win32.hlp file an example call is...
MFC42.#823_operator new
it seems c app but new to me
@copyleft no there were no invalid thunks which i cut iat was restored succerfuly

[Kerlingen]

Did you dump the program at OEP? Many high level programming language programs don't work correctly any more if some variables are already initialized.

copyleft was not thinking of invalid APIs but of missing APIs. Sometimes the automated unpacking tools guess a wrong start or end address for the IAT so that some functions are never imported. However, this would most likely result in a app crash and not in a missing menu bar.

[yogi_saw]

Yes it was unpacked with automated unpacker but i think it it is referencing to unexiting code in same exe. Do windows give any err if code referenced not exist