From e01f5ac2de18b2e2c0fcc48c0c5a711cde7a7b6e Mon Sep 17 00:00:00 2001 From: HaRoLd <303926+HarryR@users.noreply.github.com> Date: Thu, 16 Apr 2026 15:31:34 +0530 Subject: [PATCH] Fix import table handling for older PE formats Handle older PE formats by using import address table if import lookup table is missing. Fixes https://github.com/decompals/wibo/issues/116 --- src/loader.cpp | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/loader.cpp b/src/loader.cpp index ea6e69c..f5509b7 100644 --- a/src/loader.cpp +++ b/src/loader.cpp @@ -678,7 +678,11 @@ bool wibo::Executable::resolveImports() { while (dir->name) { char *dllName = fromRVA(dir->name); DEBUG_LOG("DLL Name: %s\n", dllName); - uint32_t *lookupTable = fromRVA(dir->importLookupTable); + + // Older PEs (NT 3.5-era) omit the ILT and only ship the IAT, which + // on disk holds the hint/name RVAs that later get overwritten. + uint32_t iltRVA = dir->importLookupTable ? dir->importLookupTable : dir->importAddressTable; + uint32_t *lookupTable = fromRVA(iltRVA); uint32_t *addressTable = fromRVA(dir->importAddressTable); ModuleInfo *module = loadModule(dllName);