PDA

View Full Version : IAT Emulation & Redirection


yogi_saw
06-29-2011, 06:22 AM
Hi friends
most often I have heard of IAT Emulation & Redirection but searching lot could not make me understand them clearly...
I would really appreciate if somebody could point me or post more info on this
and also the ways to remove IAT Emulation & Redirection and difference in both technique

SunBeam
06-29-2011, 09:49 AM
IAT redirection refers mainly to replacing an entry in the IA table with directions to another function inside the protector. Emulation does a similar thing, but the address the direction points to contains the whole API, obfuscated or whatnot, instead of the reference to the API (a JMP or CALL).

Git
06-29-2011, 11:52 AM
As some of you saw, there is an excellent description of this on Exetools today :

http://forum.exetools.com/showpost.php?p=73793&postcount=2

Git