errr.. that's how I fixed the dump, except imprec doesn't 'teach' you how to make multiple OS compatible dumps :)

which is why you should stop being a tool monkey and code your own dumper :p

Well, you should at least check 'Renormalize imports' to ensure support on Win98, dunno about the other stuff.
If FirstThunk is right, everything should work fine. To be a bit more sure check 'Rebuild Original FT', so OFTs are availible as well.

I'd never try bound imports which causes more problems than the 'normal' ones...

A new section including a new built IAT is also not a bad idea, if you ask me, I always use it when fixing ASPro or Arma.
When I fix Import Elimination thingie with the "unreadable IAT" with my script, I need that option anyway... :(

@TippeX: I like being a Tool! Not sure about the monkey bit though :) Anyway, it doesn't matter whether you use someone elses tool or one you coded yourself, it's still being a tool monkey :p

I'm not a coder anyway so, it's really difficult to get to grips with this, not seen many tutes and those I have are too technical and assume lots of prior knowledge. I know just how difficult learning this stuff is, and some of it is really scary.

@Muji-FightR: Tried those settings on a Win98/XP target but still no go under Win98, XP still works though. You know somethings wrong because of RestoreLastError popping up but fixing that didn't help, so me knowing something substantial about Kernel API's, PE files and IAT would help :rolleyes:

Well, this isn't a coding topic, so let's just see if anyone else can get that EXE to work on their XP systems!

IAT/Import Table isn't hard whatsoever, kind of weird, but if you take yourself about half an hour of reading, most of it should be clear...
This knowledge isn't always needed, but it can make things way easier...
I already wrote a tutorial about the import section which took me 3 hours to write... well, it's pretty hard to describe all that :D

And you cannot just "learn" Kernel APIs, it's more of getting info on the way, by reading tuts along with some small hint about this API etc., except you're coding...
I always came along w/o coding knowledge, tried my skills at C++. but I'm not good at PHP either, so wtf should I be good at in C++ lol
So far Ollyscript always did the job for me ;)

BarryB: The crack is not working for me. I only get a critical error. I run WinXP SP2 with all upgrades.

I like injecting ASM code more, cus you can actually debug it and see what is wrong with it... easier to work with IMO.

Do you have KB917422 installed? If so try uninstalling it from Add/Remove and see if it works then. This update is known to stop some games working!

@Muji-FightR: I have read some info on Import Table, parts make sense but some don't. I also noticed one thing that may be wrong with my dump, image base of the new IAT. Most programs I've looked at have the IAT under 0x00100000 and mine ends up at 0x00490000 (maybe screwing the Win9x compatibility in other dumps?).

Hey Barry, i dont have FEAR, but a friend of mine tried your NOCD and said no go :(

Actually, I do not have that update installed. KB917422 I mean. I heard before that I should not install it.

image base of the new iat? huh?

only the executable has an image base.. the iat is baseless, what you mean is its va.. and the va of the iat can change, provided the import table itself (the part which gets filled with the va's of all the lovely api's) remains the same.. no fixups required then... if it changes then you have lots of fixups to do for practically every ff 25 / ff 15 in the exe.. fun fun fun

If I understood you right, you can just check 'Create new IAT' in ImpRec, it should patch the Call / Jmp Dwords (ff15/25) to the newly created IAT which resides inside the .mackt section...
Guess with base of IAt he means the beginning...

hmm but theres multiple iat's in the dump...

one from the initial wrapper, and one from the 'virgin' executable,
so changing the ff 15 / ff 25 stuff can be very error prone, unless a 'merged' iat is used, and then you have the dilema of it actually accurately patching a real call/jmp and not fpu code or something similar (easiest way i do for that is check alignment, opcode length, bytes preceeding the ff 15 / ff 25 etc..)

gets very tricky, for some prots :)

@TippeX: I think I meant it's image as in memory, meaning it's address in memory as you've pointed out. There's probably some sections that can be removed, but then it means cleaning up the dump so it still works, which is beyond me.

Sorry it doesn't work for anyone else but me, a consequence of dumping/fixing on my own system I guess :rolleyes:

No big deal, I don't even play FEAR. If I would, I'd play 1.06 with no-cd crack. Doesn't matter to me.