Correctly Dumping Unpacked DLL's

[asterix]

For the ASPack not needed ImpRec

_______________
Best regards,
Asterix

[ricnar456]

Only i say changing a mark in IMP REC options, work with dll (obvious if is necesary)
I only unpack armadillos and asprotected dlls, and is necesary in this cases

Ricardo

[redbull]

Hi Guys,

Thanks for your help.

Two things.

1. I was not sure that I was dumping the DLL correctly.. But looking at other posts on hxxp://www.woodmann.net I reliazed I was dumping correctly.

2. I was incorrectly calculating my relative offset for the entry point. To patch the PE header with.

What happened was (and these values are for one specific dump)

The DLL entry point was at 09F1000 but the PE Header started at 09F0000.

The OEP was at 0A79000 (for example) [ quite a large DLL unpacked ] I was subtracting the DLL entry point and not the PE Header offset to get the Base Address Modifier value. (STUPID STUPID)

Now when I put the correct address I did not even need to use IMPRec ... I simply edited the dumped DLL using LORDPE and bingo it fucking worked!

Thanks for you help and sorry for my stupidity !!!

Here are some references for anybody else having trouble with this:

hxxp://www.woodmann.net/forum/showthread.php?t=5898&highlight=dump+dll

hxxp://www.woodmann.net/forum/showthread.php?t=3824&highlight=dump+dll

Here is a brilliant article on just this type of thing
hxxp://www.woodmann.net/yates/lad.txt

l8r

REDBull

[JMI]

Hum..... There is something quite familiar about those references... I just can't quite get my fingers on it, but I'd swear I have seem them somewhere before.

But that happens when one gets older. You begin to think you've seen most everything before. I' think I know someone named Woodmann though, just can't remember from where.

Regards,

[redbull]

Originally Posted by JMI

There is something quite familiar about those references... I just can't quite get my fingers on it, but I'd swear I have seem them somewhere before.

But that happens when one gets older. You begin to think you've seen most everything before. I' think I know someone named Woodmann though, just can't remember from where.

HEHHEE

Well i guess it is a lesson for me ... Check with the other Forums before you post a dumbass question :P

hehehe