search

lief-project / LIEF

LIEF - Library to Instrument Executable Formats (C++, Python, Rust)
https://lief.re
Apache License 2.0
4.51k stars 626 forks source link

DLL corrupted when set build_imports == True #124

Open ba0f3 opened 6 years ago

ba0f3 commented 6 years ago

I followed PE Hooking tutorial, but my dll becomes corrupted after I rebuild it w/ builder.build_imports(True). IDA told me that the imports segment seems to be destroyed.

romainthomas commented 6 years ago

Hi @ba0f3 You should add patch_imports as well: builder.build_imports(True).patch_imports(True)

ba0f3 commented 6 years ago

Im sorry for late response! Yes I had both of them, but it's still error

romainthomas commented 6 years ago

As LIEF doesn't use disassembler, the rebuilding of the import table only works if there only call like on the IAT. Your DLL maybe do some lea on IAT entries so that building/patching doesn't work

waruqi commented 4 years ago

same problem for me.