xarti
December 17th, 2010, 16:52
Hi,
Some time ago I started playing with PE files. I tried to modify the import descriptors. I wrote a simple app which copies import data to a separated section. I encountered a problem with bound imports.
I tried to unbind an executable. I removed the bound data, copied rva's from OriginalFirstThunk to FirstThunk zeroed the OriginalFirstThunk, TimeDateStamp and ForwarderChain.
However when I try to run the app after the modification I get an error 0xC0000005 the app has not been initialized correctly. I'm trying to figure it out by myself but have no idea what I've done wrong.
Any help would be really appriciated.
In an attachment there is a source code of the app which I wrote, the file I used for testing and a modified version of a testing file (the one which I tried to unbind).
Thanks,
xarti
Some time ago I started playing with PE files. I tried to modify the import descriptors. I wrote a simple app which copies import data to a separated section. I encountered a problem with bound imports.
I tried to unbind an executable. I removed the bound data, copied rva's from OriginalFirstThunk to FirstThunk zeroed the OriginalFirstThunk, TimeDateStamp and ForwarderChain.
However when I try to run the app after the modification I get an error 0xC0000005 the app has not been initialized correctly. I'm trying to figure it out by myself but have no idea what I've done wrong.
Any help would be really appriciated.
In an attachment there is a source code of the app which I wrote, the file I used for testing and a modified version of a testing file (the one which I tried to unbind).
Thanks,
xarti