Author: Rob Bone (LRQA Nettitude)
Fix stomped imports
Recover the imports from a stomped PE header by pasting in an IAT dump from dynamic analysis.
Simply copy the IAT during dynamic analysis using e.g. x64dbg and paste it into the plugin dialog.
See the blog post for more details: https://labs.nettitude.com/blog/binary-ninja-plugin-fix-stomped-imports
Live malware example sample: acf361296c9e1cf5b4ceff11e1790c57e6e1d753df9bef087aadad256dc5a123
5529
This plugin is released under an MIT license.
2