Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 06-23-2005, 18:31
lordnasty lordnasty is offline
Friend
 
Join Date: Sep 2004
Posts: 32
Rept. Given: 5
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 34
Thanks Rcvd at 1 Time in 1 Post
lordnasty Reputation: 0
Problem unpacking a Morphined .exe

Hi to all,
i have some problem to unpack an exe file that PEid tell me that is packed with:

Morphine 1.4 - 2.7 -> Holy_Father & Ratter/29A

So i follow the GOOD tutorial made by KaGra.
So after i find the "magic" jump "JMP EAX" to the OEP, i stop and dump using Ollydump putting the new OEP and uncheck "Rebuild Import".
After i use the PE Editor of LordPe and look to Sections.
I have 4 sections the bit .text section and 3 sections (with size 1000 each).
Automatically Ollydump put me the total size of the sections so i delete the 3 sections and utomatically i have the size - 3000 big (the 3 sections * 1000).
After i check the size of the .text section and VirtualSize = Rawsize = and is .text section size - 1000 (the PE header size).
I save all but the app not start (error: ReadProcessMemory or WriteProcessMemory partially complete).

Please can help to understand what i mistake?
Ah .. the ImageBase is a strange 19F0000 (not the usually 01000000 or 00400000).
THX
NaSTy
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Armadillo 8.6 unpacking problem eAGLe_eYe General Discussion 8 03-11-2013 22:43
Unpacking problem Pompeyfan General Discussion 16 01-11-2004 19:40
Manual Unpacking problem Nilrem General Discussion 15 01-10-2004 17:41


All times are GMT +8. The time now is 22:39.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )