conco/OpenMaidEngine
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 3 Wiki Activity

re: document pe-sieve IAT failure on packed AGE.EXE; queue Frida import-map

Browse Source 
pe-sieve /imp on the running game gave ~17 genuine imports (packer
bootstrap + one-per-DLL seed) and 300+ spurious stray-DWORD guesses:
the exe ships a zeroed IAT resolved via GetProcAddress, so there is no
conventional IAT to rebuild. Do not graft the output. Task B re-scoped
to a Frida live import-map (runtime_addr->dll!Func, RVA->name, label the
/v2 image); design captured in engine-re.md runbook.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
gamer147
2026-07-09 08:54:08 -04:00
parent ace8ddf8eb
commit 23f518f39b
2 changed files with 30 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/superpowers/plans/2026-07-09-re-tooling-handler-labels-and-iat.md
View File

@@ -1,5 +1,14 @@
# RE Tooling: Handler Labeling + IAT Reconstruction — Implementation Plan
> **STATUS (2026-07-09):** **Task A COMPLETE** (committed `97fb1d6` on `feat/re-tooling-handler-labels`) —
> whole-image dispatch-handler labeling landed; see the status memory + `docs/engine-re.md` "Materialized +
> applied image-wide". **Task B (pe-sieve IAT graft) ABANDONED — the premise fails on this packed binary**
> (zeroed IAT, `GetProcAddress`-resolved imports; pe-sieve produced ~17 genuine + 300+ spurious entries).
> See `docs/engine-re.md` runbook "IAT reconstruction — tried, DOESN'T WORK". **Task B is re-scoped to a
> Frida live import-map** (build `{runtime_addr→dll!Func}` from the live process's module exports, read the
> engine's resolved import-pointer storage → `RVA→name`, label the `/v2` image) — that gets its OWN
> spec/plan when picked up; the pe-sieve Task B below is retained only as the record of what was tried.
> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
**Goal:** Eliminate two recurring native-RE taxes — Kelebek VA-drift and unnamed imports — by (A) auto-labeling every opcode dispatch handler in the Ghidra image and (B) grafting reconstructed IAT names onto that same image.