seliaste/lief-iat-reconstruction
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Modified test file to include register values at entry

Browse source
This commit is contained in:
Aéna Aria 2026-03-25 15:18:01 +01:00
parent a57491f2b6
commit 3f0e52d3b6
1 changed files with 28 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

29
rsc/upx-hostname.exe.bin_iat_wave1.json
View file

@ -1 +1,28 @@
{"entry": "0x10011d7", "calls": [{"adress": "0x10011e6", "name": "KERNEL32.DLL!GetModuleHandleA"}, {"adress": "0x1001243", "name": "MSVCRT.DLL!__set_app_type"}, {"adress": "0x1001258", "name": "MSVCRT.DLL!__p__fmode"}, {"adress": "0x1001266", "name": "MSVCRT.DLL!__p__commode"}, {"adress": "0x10013be", "name": "MSVCRT.DLL!_controlfp"}, {"adress": "0x1001358", "name": "MSVCRT.DLL!_initterm"}, {"adress": "0x10012cb", "name": "MSVCRT.DLL!__getmainargs"}, {"adress": "0x10010f2", "name": "WS2_32.DLL!WSAStartup"}, {"adress": "0x1001160", "name": "WS2_32.DLL!gethostname"}, {"adress": "0x10011ba", "name": "USER32.DLL!CharToOemBuffA"}, {"adress": "0x10011c7", "name": "MSVCRT.DLL!puts"}, {"adress": "0x10011d0", "name": "MSVCRT.DLL!exit"}]}
{
"entry": "0x10011d7",
"calls": [
{ "adress": "0x10011e6", "name": "KERNEL32.DLL!GetModuleHandleA" },
{ "adress": "0x1001243", "name": "MSVCRT.DLL!__set_app_type" },
{ "adress": "0x1001258", "name": "MSVCRT.DLL!__p__fmode" },
{ "adress": "0x1001266", "name": "MSVCRT.DLL!__p__commode" },
{ "adress": "0x10013be", "name": "MSVCRT.DLL!_controlfp" },
{ "adress": "0x1001358", "name": "MSVCRT.DLL!_initterm" },
{ "adress": "0x10012cb", "name": "MSVCRT.DLL!__getmainargs" },
{ "adress": "0x10010f2", "name": "WS2_32.DLL!WSAStartup" },
{ "adress": "0x1001160", "name": "WS2_32.DLL!gethostname" },
{ "adress": "0x10011ba", "name": "USER32.DLL!CharToOemBuffA" },
{ "adress": "0x10011c7", "name": "MSVCRT.DLL!puts" },
{ "adress": "0x10011d0", "name": "MSVCRT.DLL!exit" }
],
"entry_reg_values": {
"EAX": "0x000cff0c ",
"EBX": "0x7efde000 ",
"ECX": "0x00000000 ",
"EDX": "0x010058c0",
"ESI": "0x00000000 ",
"EDI": "0x00000000 ",
"EBP": "0x000cff94 ",
"ESP": "0x000cff8c",
"eflags": "0x00000203"
}
}