nikolatesla20 thnkx ... but doesn't work =-( ..Look

i dump file and select dumped file in memory ...with ImpRec ..now i put OEP that is DD5CC , push "IAT AutoSearch" .. ..wops!!..

"Could no find anything good at this OEP ! :-( "

='( ... It is not important if process chooses ... Always this mistake goes out for me... now .. if i leave the OEP that has the ImpRec predetermined ... It gives me the result:

RVA 00121000 Size 000001F4

It´s correct =-P ... but i try "GetImport" ...And return to the same thing ...It is not important if process chooses ....always the IAT is quite correct ...why?¡ ....my dump is bad?¡ ... ..please help me ... i really not understand =-( ....what is wrong? ...


Thank u =-)

Which program are you doing? the Screensaver?

Anyway DO NOT put in the OEP, neither ImpREC OR Revirgin really need it.

What you want to do is TELL ImpREC where the IAT starts yourself. You can do that by just filling in the IAT start and length values yourself, in the text boxes. Then, instead of pressing "IAT search", just push "Get Imports".

In a program like this, you have to tell it manually where the IAT starts and how long it is. You can do that by finding an import address (such as a call dword ptr [xxxxxxxx] instruction) and going to this xxxxxxxx address in SoftICE, and then scrolling up to find the IAT start, and then down to find its length.

I suggest you study how an IAT looks in memory some more. Also, perhaps you didnt know that ImpREC and Revirgin would work if you just put in the numbers yourself. In that case, now you know. Revrigin, however, will still not work on this.

-nt20