PatchImport, IMAGE_IMPORT_DESCRIPTOR end of array determined by wrong structure member

[fastman92]

AVERM.dll problem
AVERM.dll loads, when loading a movie in GTA games.

It was found during the testing, that Visual Leak Detector for Win32 will crash the game, when the following file loads:
C:\Windows\SysWOW64\AVERM.dll
This file is COM registered library, one of DirectShow codecs.
"RealAudio Decoder",{941A4793-A705-4312-8DFC-C11CA05F397E},00400000,"C:\Windows\SysWow64\AVERM.dll"
"RealMedia Source",{765035B3-5944-4A94-806B-20EE3415F26F},00600000,"C:\Windows\SysWow64\AVERM.dll"
"RealMedia Splitter",{E21BE468-5C18-43EB-B0CC-DB93A847D769},00600000,"C:\Windows\SysWow64\AVERM.dll"
"RealVideo Decoder",{238D0F23-5DC9-45A6-9BE2-666160C324DD},00400000,"C:\Windows\SysWow64\AVERM.dll"

AVERM.dll is packed by UPX compressor.
The VLD plugin crashed within PatchImport function with HMODULE address of AVERM.dll.
Initially I have expected that one of my codec files is crashing my application.
After a debugging process, which took me 2 days I have figured out what’s wrong.

Solution:
File vld-master\src
Function:
BOOL PatchImport (HMODULE importmodule, moduleentry_t *patchModule)
Find:
while (idte->FirstThunk != 0x0) {
Change into:
while (idte->OriginalFirstThunk != 0x0) {

Explanation:
An array of _IMAGE_IMPORT_DESCRIPTOR finishes, when the first structure member is filled with zeros:

    union {
        DWORD   Characteristics;            // 0 for terminating null import descriptor
        DWORD   OriginalFirstThunk;         // RVA to original unbound IAT (PIMAGE_THUNK_DATA)
    } DUMMYUNIONNAME;

Not this one, which has got a similar name:
`DWORD FirstThunk; // RVA to IAT (if bound this IAT has actual addresses)

`
Now AVERM.dll is the library, where the last entry has got FirstThunk with some random value and proper OriginalFirstThunk=0. The Visual Leak Detector was reading an invalid value and executing FindRealCode badly.