hi is there any tut about fixing imports with ImpREC without adding new section
as dumped exe have five section after deleting fifth section i have to fix imports with these four remaining sections
plz any advise

| Сообщение посчитали полезным:

When edited dialog "New import infos" - uncheck checkbox "Add new section". Then push "Fix dump".



| Сообщение посчитали полезным:

i tried it , gives error invalid rva it does not match a section
how to question is how to fill new import infos (IID+ASCII+LOADER) RVA and size [FFILE=c756_13.05.2015_EXELAB.rU.tgz] - Capture.JPG

| Сообщение посчитали полезным:

Make dump of working program and with hex editor find visually required values in this dump.

See also --> here <--



| Сообщение посчитали полезным:

Section with an old import must be nulled before fixing the dump.So if you want to replace original import table with fixed one just put New Import info with RVA = Beginning of old import section.Size of IT detected automatically.But if an old import section contain any other data you can't fix your dump without new section.Only full PE rework can help you with this.

-----
TEST YOUR MIGHT

| Сообщение посчитали полезным:

got it , i try it adding new section and it is not working at all but in this case is little bit different
check it , i use uif to get unresolved imports
is it possible that we can fix iat
https://www.dropbox.com/s/q7kzkc875axx8ny/unpacking%20hasp%20srm.zip?dl=0
thank

| Сообщение посчитали полезным: