Fixed the bug where the program crashed due to the presence of "?.DLL” after import reconstruction

[shuiyc]

Although I don't know why "?.DLL" appeared — it shouldn't have been in the IAT in the first place. So, when I commented out addNotFoundApiToModuleList , the "?.DLL" no longer appeared, and the program ran normally. I think if an API is not found, it should not be added to the modulelist. This approach would prevent invalid entries like "?.DLL" from causing crashes in the repaired program. #90

[kevoreilly]

Hi shuiyc! Thanks a lot for looking into this. It's a strange problem - I was planning to reply to your issue to say that it is not always a problem - at least in my testing I have not seen any apis not found. But I haven't really tested very many examples!

So I am of course willing to consider making this change to just remove the call to addNotFoundApiToModuleList, I do think it's worth being careful and asking the question: where did this unfound api originate from? It seems that since there is even a dedicated function in Scylla called addNotFoundApiToModuleList it must serve a purpose.

So before I think we should proceed to just comment out this call, we should first answer these two questions:

• what is the reason for the presence of unfound apis in only some samples?
• what is the purpose for the addNotFoundApiToModuleList function and would this be needlessly undermined by these changes when the root of the problem might exist elsewhere?

If you can share the example you are testing with that would be really helpful. If you also have the original sample prior to packing with upx that would be even more helpful!

[shuiyc]

Sure! I would like to share my sample. I compiled sample.c using Visual Studio to generate a 32-bit sample.exe. They and the UPX-packed sample-upx32packed.exe are all in sample.zip.
sample.zip

[kevoreilly]

It's getting late for me now but already in IAT parsing finished, found 41 valid APIs, missed 1 APIs we can see a problem as the original exe only imports 41 functions! I suspect there is an off-by-one bug in there somewhere, and I will find it! It just might have to wait until after the weekend!

Thank you 🙏