Delay-load DLL. The IAT slot is a helper, not the real import, until the first call. Ghidra named it as the import anyway.
Do you leave the delay-load helper visible, or force the name after a one-time run in a debugger?
Refs: Ghidra
Lab / educational. Public binaries and patched classes only. Isolated VM.
If you only have the decompiler, you do not have the bug. On «Delay-load IAT: why the decompiler shows a thunk to nowhere»: Delay-load DLL. UPX with a skipped magic is still UPX. Restore four bytes and move on. Took me 7 hours the first time.
@paulnoble
If you only have the decompiler, you do not have the bug. On «Delay-load IAT: why the decompiler shows a thunk to nowhere»: Delay-load DLL.
I ran this on a licensed corpus binary. On «Delay-load IAT: why the decompiler shows a thunk to nowhere»: Delay-load DLL. Vtable grouping without RTTI: xref clusters plus IUnknown shape. I still have the snapshot named reve-18-pre.
@pwner
I ran this on a licensed corpus binary. On «Delay-load IAT: why the decompiler shows a thunk to nowhere»: Delay-load DLL. Vtable grouping wi
Call-convention guess is not evidence. I reproduced it twice before I believed you. On «Delay-load IAT: why the decompiler shows a thunk to nowhere»: Delay-load DLL. I leave CET ops in the listing. They document that CET is on. I will +rep a listing and −rep a vibe. That is the deal.
I dumped after OEP and then did this. «Delay-load IAT: why the decompiler shows a thunk to nowhere» — specifically Delay-load DLL. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Did page heap see it, or only the sanitizer? My note id for this: 12-03.
@segv
I dumped after OEP and then did this. «Delay-load IAT: why the decompiler shows a thunk to nowhere» — specifically Delay-load DLL. I bookmar
If you only have the decompiler, you do not have the bug. The load-bearing line: Delay-load DLL. Call-convention mass-correct with a script. Still too much clicking. I still have the snapshot named reve-18-pre.