Jump to content
Tuts 4 You
HellRaider

scylla is getting wrong va and size.

Recommended Posts

HellRaider
Posted (edited)

I am unpacking AvaFind.exe, but scylla is getting wrong va and size via IAT autosearch. But when i try imprec it resolves correct address and size. Tried looking into scylla code but could not understand the issue.

scylla.jpg

AvaFind.exe

Edited by HellRaider (see edit history)

Share this post


Link to post
Share on other sites
HellRaider
Posted (edited)

The application is correctly unpacked in both the app

Edited by HellRaider (see edit history)

Share this post


Link to post
Share on other sites
mrexodia

Perhaps you can try 'Use advanced IAT search' in options

Share this post


Link to post
Share on other sites
LCF-AT

Just check the IAT start & End / Size manually in Olly and correct it if needed and then you are on the safe way.No big deal to do this quickly by yourself without always to trust blind any import tool.In this case ImpRec shows all correctly but also ImpRec can fail etc.Just wanna say that you should verify the found and shown results you know.

greetz

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×