Basic knowledge of cainiao shelling (6) -- manual searching for IAT and fixing Dump programs

We have discussed how to search for OEP and shelling. Sometimes, it cannot run normally when Dump is out, because another input table is not processed, and some encryption shells will make a big fuss about IAT encryption, replace the actual IAT address with the shell address of the HOOK-API, so that the shelling cannot correctly restore the original IAT of the program, so that the program cannot be cracked, so our solution to these encrypted IAT addresses is to find the Jump (Magic Jump) to encrypt these IAT addresses and change it to force redirect (JMP ), so that it cannot encrypt the IAT, so as to achieve the purpose of shell repair!
Because the IAT of the program is arranged consecutively, we only need to find the start position and end position of the IAT to determine the IAT address and size! Some IAT are of the JMP type and some are of the CALL type. Therefore, to determine the IAT address, you must first know how this program calls IAT. For example:

The corresponding assembly is call dword ptr ds: [465198], that is, directly calling the function in [465198]. Address 465198 is in IAT and points to the GetVersion function, right-click the command 004464F7 and follow it to the data window, memory address!

In this case, 465198 is part of IAT. You can view its content in the data window:

Right-click, long type, and view the address:

In this way, you can see the name of other functions:

We flip up and find the interval of dword whose data is 0, and IAT ends with 0:

The IAT address of the shell program is: 00464FFC, so its size is: 00465698-00464FFC = 69C.
Now you can use ImportREC to fix it!

Enter the OEP and the RVA and size of the program you just obtained, click get input information, repair the file store, capture the DUMP program, and repair the program. After the repair is completed, run the repaired program, the program can run normally:


Attachment of the downloaded version:
Http://www.bkjia.com/uploadfile/2012/1205/20121205071819691.zip