Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Improve recognizing when to rebuild import table from scratch #89

Closed
hasherezade opened this issue Sep 3, 2021 · 1 comment
Closed

Improve recognizing when to rebuild import table from scratch #89

hasherezade opened this issue Sep 3, 2021 · 1 comment

Comments

@hasherezade
Copy link
Owner

Example:

  • Project1.vmp.exe
    This crackme is packed with VMProtect, and a new Import Table is loaded during the execution.

PE-sieve run with option /imp 1 (autodetect) reports that the import table is fine, and does not need the reconstruction:

imp_ok

However, seeing the report with imports (400000.Project1.vmp.exe.imports.txt) we can see that there are additional IATs. Such condition should be a trigger to rebuild the whole table.
hasherezade added a commit that referenced this issue Sep 3, 2021
@hasherezade
[FEATURE] If new IATs detected, recreate full table (Issue #89)
15b446b
@hasherezade
Copy link
Owner Author

Result - if run in /imp 1 mode, detection of additional IATs cause Import Table recreation :

imp_result

hasherezade added a commit that referenced this issue Sep 4, 2021
@hasherezade
[BUGFIX] Treat as a new IAT only those that have more than 1 thunk (I…
7ccc63a 
…ssue #89)
hasherezade added a commit that referenced this issue Sep 5, 2021
@hasherezade
[FEATURE] Recreate import table on autodetect only if a new table is …
27f346e 
…bigger than the default (Issue #89)
hasherezade added a commit that referenced this issue Sep 10, 2021
@hasherezade
[BUGFIX] In imprec auto mode: do not recover imports of .NET modules …
fe11969 
…(Issue #89)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@hasherezade