I am learning some reverse engineering and stumbled upon a problem. I have followed the tutorial that is included inside the unpackMe package but I sense that there is a problem because of me running windows 10.
The problem is that the API's found by ImpRec is being marked as invalid, even though they are infact listed inside the memory block when looking with ollyDbg.
A screenshot:
It might also have something do with the AcLayers in between the Kernel32 dll.
What to do?
Assuming you know which are the correct APIs that should be imported, as this seems to be the case
Using ImpRec you can manually fix those two invalid import records by right clicking on them and using one of the many more advanced import lookup functionalities. Experiment to figure out which ones are working best for a set of packers.
If that fails, you can always save the tree to dist, edit it manually with the correct information and then load it back.