Import Reconstructor 1.7c - Fixed by Newbie_Cracker
From:EXETOOLS
Hi buddies.
As you know ImpRec always has had problem to fix imports of dumped DLLs because of rebasing. It reads ImageBase from memory, but uses ImageBase of dll from header to calculates RVA of JMP/CALL API.
To fix that manually, you had to change ImageBase of dump to its value of mapped dll, and then fix imports by ImpRec.
By this fix, you don't need above procedure anymore. I patched ImpRec to overwrite ImageBase of dump with its new value.
There are some screenshots in attachment for comparison of v1.7c orginal and patched version.
发表于 2010-8-3 17:47
发表于 2010-8-3 17:59
