Skip to content

Import reconstruction misses some entries #131

@hasherezade

Description

@hasherezade

Sample

win10.zip

Issue

Two imports are missing from the reconstructed import table:

Image

However, they have been correctly recognized, because they are present in the report:

1dee14,76375d30,user32.CallWindowProcW #1538
1dee18,7637bca0,user32.CallNextHookEx #1536
1dee1c,76381a60,user32.BeginPaint #1522
1dee20,7636e110,user32.AdjustWindowRectEx #1509  <== missing
1dee24,76381680,user32.ActivateKeyboardLayout #1505 <== missing
1dee2c,76164800,gdi32.UnrealizeObject #1954

Import reconstruction option: /imp A.
Complete imports listing:

400000.win10.exe.imports.txt

Complete dumped material:

process_2480.zip

The dump has been made with the executable being paused at OEP, RVA = 0x1D14B0.

Metadata

Metadata

Assignees

Labels

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions