![]() |
|
#4
|
|||
|
|||
|
I've dumped many PECompact dll's successfully. Any problems have almost always been in the relocations area. If it is a relocations issue search for the great program called "Relox".
1) load .dll into default base address, dump at OEIP, call "dumped_10000000.dll" 2) modify target .dll to new base address, say 0x20000000 (can do this with PECompact targets fine) 3) load .dll again, dump at OEIP, call "dumped_20000000.dll" 4) start Relox, load dump1 in slot1 then dump2 in slot2. 5) Do a compare in Relox and it will rebuild relocations for you 6) Use Relox to add new .reloc section to your "dumped_10000000.dll" Good luck! |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| SoftICE crashes with NVIDIA 81.x/82.x drivers | Kerlingen | General Discussion | 17 | 03-11-2006 15:22 |
| Ida2Sice crashes Softice?! | bEaST | General Discussion | 0 | 09-07-2005 22:17 |
| Armadillo crashes Olly | Flagmax | General Discussion | 19 | 01-28-2005 09:47 |
| OllyScript 0.85 and Olly 1.10 crashes ??!? | Shub-Nigurrath | General Discussion | 6 | 07-11-2004 19:10 |