I'm having some trouble getting the imports to come up in w32dasm, after unpacking a neolite1.1 packed exe.

I've been reading alot trying to get a better understanding of how to manually rebuild/unpack files, but its been a bit confusing (I'm learning more each time I re-read the tuts and threads though!)

So my approach was determining how the exe was packed using PE-Scan, then I unpacked it with ProcDump. After dumping it, the program would give an error that it could not initalize properly. I rebuilt the PE using ProcDumps rebuilder, all the standard options except I chose "rebuild the import table". It worked succesfully and the program executed fine then.

However, when I check out the exe in w32dasm, the imports don't come up. After searching the threads I found what I thought was the answer to my problems:

-------------------------
The Imports aren't encrypted with Neolite and the program should run fine as dumped, but if you want to see them with PEditor or W32Dasm, you need to change the RVA of the Import Table to the real one, not the one pointed to in unpacking code. This is an address in the Optional Header that points to the Image_Import_Descriptor (IID) table, a set of 5 DWORDS that gives information about each dll. One way to find this address is to do a hex search for the starting address of the IAT, which is at 89000, the beginning of the .rdata section. If you search for "009008" you'll land in the middle of the IID table. Find the starting address offset for this table and change the RVA and size of the Import Table as shown in PEditor to the correct values (A4F90 and 104) and you should see the proper Imports in a disassembly.

Kayaker
--------------------------

But I'm having a hell of a time getting this to work. I tried a few different approaches, like loading up the dumped/working exe into ReVirgin and having it dump the IT, then I tried inserting that into a new section of the exe and pointing the IT RVA to that... all with no success.

I'm not giving up, I'm just hoping to get some insight! I'm probably just too tired.. maybe another set of eyes will help. Thanks.

Hi xkrylonx

Wow, that thread was over a year and a half old and I had to redump Neolite packed notepad just to remind myself how to do it I think you've got the same situation, the RVA in the Import Table entry of PEditor needs to point to the start of the IID. Try it on notepad and see where and what this actually is (at the start of the .idata section at 6000, the IAT proper starts at 62E0 (Win98SE). For a good explanation of the Image_Import_Descriptor I usually recommend Understanding Import Tables by Yates (Immortal Descendants Archives).

For your unknown dumped app that works but doesn't have fully described imports yet, you can probably find the middle of the IAT by looking at the first API call in the program *before* Softice resolves it as you step over it. i.e. with notepad, the first call looks like 'Call [4063E0]', which SI will resolve to GetCommandLineA when you F10 over it. 4063E0 is somewhere in the middle of the real IAT. Display this address and scroll around that section until you find the start of the IID (at 6000). You can learn to recognize the array of 5 DWORDS describing the IID by studying notepad. The IID isn't necessarily at the beginning of the .idata section, but that's a good place to start, if not you'll have to search around. Once you've found the start of it and its size, enter these values under 'Import Table' in PEditor and the imports should be resolved.

I'm not really a fan of using ProcDump or the like to dump and rebuild imports, I usually do an Icedump raw dump with /DUMP 400000 [size of image] [filename] and fix up RS=VS and RO=VO (OK, I'm lazy and use PEditor for this), and fix up any import pointers manually if necessary. This is just my personal preference. If you've already tried rebuilding the imports and the file has been "optimized" by an external app then you've got to account for any differences in Raw and Virtual offsets in any further modifications you might want to make including patching.

Let me know if this makes sense,
Kayaker

Glad I caught this before I went to sleep!

Well first, I'm running Win2k + the DriverSuite version of SoftIce... although I'm considering setting up one of my other computers with 98se again just for cracking work, because almost all of the tuts use IceDump and such!

The target is BlackWidow v4.16 (there is a newer version, not sure if its packed the same), as I forgot to mention in the prior post. I read some more threads and tried to use ImpRec to restore the imports as well.. but still the same result.

I will check out those archives you mentioned, and also examine packed versions of notepad and hopefully get a better feel for what is going on.

Thanks for the help, I'll be posting again soon..