Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #7  
Old 04-21-2005, 04:39
amitophia
 
Posts: n/a
Program's not working under xp sp0 too. And that's why:
If you look at the import table you can see that all entries are referenced by ordinals.
This means that it will work only with those versions of dll's which was loaded when you've dumped target. For example, kernel32.dll!Beep has ordinal number 27 in xpsp0 and number 29 in xpsp2.
To work around this problem, go to xpsp1, convert all ordinal imports to name imports (maybe it cannot be done with all imports. If it's the case, leave ordianls for such dlls)
I think there're some tools that can do this automatically. You can load unpacked program and dump it with option "Reconstruct imports" (or something like this) set.

Last edited by amitophia; 04-21-2005 at 04:41.
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
IDA .sig file doesn't work when target is 16 bits? ycloud General Discussion 4 04-24-2004 22:44


All times are GMT +8. The time now is 13:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )