|
|
|
|
#1
08-17-2005, 14:30
|
|||
|
|||
Thank you first al-kaiser;
but i can't got that file,,, server say error: Fatal error: Maximum execution time of 30 seconds exceeded in /home/admin1/public_html/src1-index.php on line 116  can you attach the file on forum for me , pelase? 
|
|
#2
08-17-2005, 16:18
|
|||
|
|||
|
Well I unpacked neolite 2 DLL's in the past without much problems.. Only thing I did different was that I manually restored the IAT instead of letting a tool create a new section with the iat in it.
Not sure if that causes your problems. But for instance peexplorer gives a warning if the IAT is in a seperate section AFTER the .rsrc section(with the export table)
|
|
#3
08-17-2005, 23:27
|
|||
|
|||
it's true wildmans,,,
you have complete knowledge about IAT & about what are you needed to changes... but i havent good mentality about that!!! i'm rally newbie. PEexplorer gives NO warning... if assume that it gives some error, I don't know what i must doing .... I think i need to get some refernces to read about IAT and PE sections first,,, but it takes long time further help plz =================== Now: one of my freinds chaged RVA of ImportTable and now it isn't crash ,,,, but when exe file started, an error message say:"Failed to initialize the program",,,,like when i remove that dll or change it's name !!! Last edited by tester; 08-20-2005 at 17:23.
|
|
#4
08-19-2005, 18:58
|
|||
|
|||
|
I'm not sure what the problem is, cos there is not enough info. about ur target.
But did u check the relocation problem? Usually unpacking of dll has a problem of relocation. If other dll - which has a same image base address with ur target dll - is loaded before ur target dll, it may cause a problem. Because image base address of the target dll is changed, and then relocation problem occured. So how about trying another image base address in dumping or using Reloxa tool?
|
|
#5
08-20-2005, 20:39
|
|||
|
|||
|
suddenLy thanX,,,
there is some dll's that they have same image base addresses,,, but i think about other things: i suggested that "Failed to initialize the program" message maybe ceated from some check routines like 'CRC Checks...' & etc... , I founded that message in the main exe file ( this exe file load dll's & program started) , but i can't trace it to find check points!(poor knowledge!) thanks to all- to help & clarify me! (as soon as possible , I will send related request on the 'Request section board' , if 'Registered User Limitions' Let me!!!) attachment = Main exe file -&- Original Name of target dll=Ararbres.dll
|
 |
| Thread Tools | |
| Display Modes | |
|
|
Hybrid Mode
