View Single Post
  #4  
Old 08-30-2005, 16:58
OrionOnion
 
Posts: n/a
Hmm...

I thought your DLL have relocation table.
Most of DLLs have relocation table for preventing load same imagebase.

For Dumping, you can choose some method.
I usually used that PE characteristics change.
If change DLL characteristic bit to OFF(0).
you can loading DLL directly at 0x10000000 on Olly or other debugger.

It is for non relocated DLL.

If DLL needs relocation.

You must set memory break at relocation instruction.

eg.
When ORG 0x10000000
10001000 : 8D05 45230010 : LEA EAX,[0x10002345] <-- will relocated instruction.

If relocated ORG to 0x12000000
12001000 : 8D05 45230012 : LEA EAX,[0x12002345] <-- Changed.

After code decrypting, memory Break set 10001002 or 12001002.
You can find where it relocated and information for relocation.
If you caught a relocation info, You can recover relocation table.
Reply With Quote