4.1.3 Fixing The Import Table

To fix the imports, go back to Scylla, and click on the IAT Autosearch button, which will scan the memory of the process to locate the import table; if found, it populates the VA and the size fields with appropriate values. To get the list of imports, click on the Get Imports button. The list of imported functions determined using this method is shown here. Sometimes, you may note invalid entries (with no tick mark next to the entry) in the results; in such case, right-click those entries and choose Cut Thunk to delete them:

After determining the imported functions using the previous step, you need to apply the patch to the dumped executable (packed_dump.exe). To do that, click on the Fix Dump button, which will launch the file browser where you can select the file that you dumped before. Scylla will patch the binary with the determined import functions, and a new file will be created with a file name containing _SCY at the end (such as packed_dumped_SCY.exe). Now, when you load the patched file in IDA, you will see references to the imported function, as shown here:

When you are dealing with some of the packers, the IAT Autosearch button in Scylla may not be able to find the module's import table; in such a case, you may need to put in some extra effort to manually determine the start of the import table and the size of the import table and enter them in the VA and the Size fields.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.15.27.232