Search code examples
reverse-engineeringimport-table

Invalid API's even though right RVA and size


I am learning some reverse engineering and stumbled upon a problem. I have followed the tutorial that is included inside the unpackMe package but I sense that there is a problem because of me running windows 10.

The problem is that the API's found by ImpRec is being marked as invalid, even though they are infact listed inside the memory block when looking with ollyDbg.

A screenshot:

Screenshot

It might also have something do with the AcLayers in between the Kernel32 dll.

What to do?


Solution

  • Assuming you know which are the correct APIs that should be imported, as this seems to be the case

    Using ImpRec you can manually fix those two invalid import records by right clicking on them and using one of the many more advanced import lookup functionalities. Experiment to figure out which ones are working best for a set of packers.

    If that fails, you can always save the tree to dist, edit it manually with the correct information and then load it back.