Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 04-28-2008, 07:41
Exocist Exocist is offline
Friend
 
Join Date: May 2002
Posts: 19
Rept. Given: 1
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
Exocist Reputation: 0
I've dumped many PECompact dll's successfully. Any problems have almost always been in the relocations area. If it is a relocations issue search for the great program called "Relox".

1) load .dll into default base address, dump at OEIP, call "dumped_10000000.dll"
2) modify target .dll to new base address, say 0x20000000 (can do this with PECompact targets fine)
3) load .dll again, dump at OEIP, call "dumped_20000000.dll"
4) start Relox, load dump1 in slot1 then dump2 in slot2.
5) Do a compare in Relox and it will rebuild relocations for you
6) Use Relox to add new .reloc section to your "dumped_10000000.dll"

Good luck!
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SoftICE crashes with NVIDIA 81.x/82.x drivers Kerlingen General Discussion 17 03-11-2006 15:22
Ida2Sice crashes Softice?! bEaST General Discussion 0 09-07-2005 22:17
Armadillo crashes Olly Flagmax General Discussion 19 01-28-2005 09:47
OllyScript 0.85 and Olly 1.10 crashes ??!? Shub-Nigurrath General Discussion 6 07-11-2004 19:10


All times are GMT +8. The time now is 19:40.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )