Jump to content
Tuts 4 You

How to use ImpREC_DLL


cypher

Recommended Posts

Posted (edited)

Hi,


has anyone used the ImpRec DLL ?


 


I added to my cpp the prototypes and code:



DWORD SetModule(DWORD pid, DWORD base);
void  LogIATEntry(DWORD rva_iat_slot, DWORD va_api);
DWORD MakeImportTable(LPTSTR dump_filename);
....
...
SetModule(fdProcessInfo->dwProcessId, fdLoadedBase);

included the header with error codes and link against ImpREC_DLL.lib


 


still getting error :



error LNK2019: unresolved external symbol ""unsigned long __cdecl SetModule(unsigned long,unsigned long)" (?SetModule@@YAKKK@Z)"

SOLVED:


add to header



#ifdef __cplusplus
extern "C" {
#endif /*__cplusplus*/
__declspec(dllimport) DWORD SetModule(DWORD pid, DWORD base);
__declspec(dllimport) void LogIATEntry(DWORD rva_iat_slot, DWORD va_api);
__declspec(dllimport) DWORD MakeImportTable(LPTSTR dump_filename);
#ifdef __cplusplus
}
#endif /*__cplusplus*/

or got the long way using LoadLibrary, GetProcAddress etc


Edited by cypher
Posted (edited)

am I supposed to call SetModule for every module loaded with the base of each module? Or just a single time before every other call?


 


right now I do



SetModule(pid, imagebase) //imagebase = 400000, base of main module loop over IAT entries {
LogIATEntry()
} MakeImportTable()

however the IAT is build and entries for kernel32, user32, shell32...are correct but entries for d3dx9 (and others) are wrong and would be correct if rebased


 


Solved:


yes you have to call SetModule for every DLL


Edited by cypher

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...