Quote:
In my last post I've stated that something like this, according to some experiments, perhaps doesn't work.
I was wrong 
I've made an error when recalculating some resulting offsets, but after fixing that stuff, everything runs fine. So it's definitely not necessary for the sections to stay in sequential order inside the file.
|
Good to know! Maybe someday that little factoid will present the perfect solution to some problem that's stumping me...
Quote:
|
Perhaps you could give me just another hint, to put my thoughts in the right direction
|
Well, for right now, I'd take things one step at a time: ignore the .mackt section and do that last, for now first focus on removing the .adata and then the .data sections. To this end, I will point out that PE editors (such as LordPE) will be a big help, as they can do deadlistings of the addresses (VOffsets) of items in the PE header, and make finding all items in a certain address range much easier.
Also, recall now my descriptions of these sections:
Code:
.data -- this section is named randomly by ASProtect, and holds ASPR's IAT, some redirected resources, etc
.adata -- this section is used as in-memory data storage by ASPR
Regards