LIEF icon indicating copy to clipboard operation
LIEF copied to clipboard

DLL corrupted when set build_imports == True

Open ba0f3 opened this issue 8 years ago • 4 comments

I followed PE Hooking tutorial, but my dll becomes corrupted after I rebuild it w/ builder.build_imports(True). IDA told me that the imports segment seems to be destroyed.

ba0f3 avatar Dec 05 '17 11:12 ba0f3

Hi @ba0f3 You should add patch_imports as well: builder.build_imports(True).patch_imports(True)

romainthomas avatar Dec 10 '17 14:12 romainthomas

Im sorry for late response! Yes I had both of them, but it's still error

ba0f3 avatar Dec 11 '17 03:12 ba0f3

As LIEF doesn't use disassembler, the rebuilding of the import table only works if there only call like on the IAT. Your DLL maybe do some lea on IAT entries so that building/patching doesn't work

romainthomas avatar Dec 11 '17 07:12 romainthomas

same problem for me.

waruqi avatar May 28 '20 14:05 waruqi