wet behind the ears
April 13th, 2001, 17:10
Where in the PE header this import data supposed to be stored (.idata?)
All by chance, I found the correct IAT Start RVA and length and Revirgin gave me all the modules, IT_ADD added IT.bin. Now I have two .idata in my unpacked .exe. It works well but, I wonder isn't it possible to disassemble the .exe? May be I should use stg other than w32dasm?
All by chance, I found the correct IAT Start RVA and length and Revirgin gave me all the modules, IT_ADD added IT.bin. Now I have two .idata in my unpacked .exe. It works well but, I wonder isn't it possible to disassemble the .exe? May be I should use stg other than w32dasm?