Hi and sorry to bother.

 

I tried by chance to unpack a PCGuard 5.xx unpackme.

 

Scylla dumps and rebuild the imports but the import table is kinda messed up.

 

Imports fixer do the job ok though.

 

I have used a wrong settings or what?

 

Here is a video in attach with the unpackme to take a look.

Thank you!

 

Question.7z

Related to 'Invalid import thunk in importrec' by any chance?

All imports are valid.

Look at the video please.

Can't download attach, but perphaps you forgot fix antidump.

Can't download attach, but perphaps you forgot fix antidump.

Here is a external link for you:

 

http://www34.zippyshare.com/v/87192739/file.html

It might be a bug with scylla.  I used an older build, 0.6 and the imports are fine.  Version 0.7 and newer have the same issue. The module name is null on the rebuild.

Thanks GIV for the bug report. Fixed with 0.9.6b: https://forum.tuts4you.com/files/file/576-scylla-imports-reconstruction/

 

This was a little math bug due to special pe sections... the last sections have 0x0000D600 as raw address, this led to a bad calculation of the name RVA

Thank you!

P.S.

You own me a beer..