Exetools - Inline patching a packed dll

Page 2 of 2

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Inline patching a packed dll (https://forum.exetools.com/showthread.php?t=2108)

drasd_20002

05-04-2003 01:48

I could not upload it here. It times out in 30 seconds tried 5 times no luck. I will give U the link hxxp://www.extremesenses.com/iupdate/iupdatefull.zip you can do a zip preview in download manger eg mass downloader and get only the dll U need 451.5kb actual size but compressed to ~42%. :)

It is strange U got a different OEP.
I checked my dll again. it works well in Xp. So is another dll in 98.
thanks for taking the trouble

asterix

05-04-2003 23:11

Hi!
Probably your version of the DLL differs from my version.

Code:

pec1:00B61160                 public start

pec1:00B61160 start:

pec1:00B61160                 push    ebp

pec1:00B61161                 mov     ebp, esp

pec1:00B61163                 add     esp, 0FFFFFFC4h

pec1:00B61166                 mov     eax, offset dword_B60ED8

pec1:00B6116B                 call    sub_A96C0C

pec1:00B61170                 mov     eax, ds:dword_B63DA0

pec1:00B61175                 mov     eax, [eax]

pec1:00B61177                 call    sub_AEC494

pec1:00B6117C                 mov     eax, ds:dword_B63DA0

pec1:00B61181                 mov     eax, [eax]

pec1:00B61183                 xor     edx, edx

pec1:00B61185                 call    @Forms@TApplication@SetTitle$qqrx17System@AnsiString ; Forms::TApplication::SetTitle(System::AnsiString)

pec1:00B6118A                 mov     ecx, ds:dword_B63ADC

pec1:00B61190                 mov     eax, ds:dword_B63DA0

pec1:00B61195                 mov     eax, [eax]

pec1:00B61197                 mov     edx, ds:dword_B41980

pec1:00B6119D                 call    sub_AEC4AC

pec1:00B611A2                 call    sub_A944B8

pec1:00B611A7                 nop

drasd_20002

05-05-2003 13:24

You R right.
I downloaded and checked the "new" version. Version number is sme but dll is different.
OEPs
000D1160 - new one
000D5C58 - old one( the one I have).
Could the author be an active member of this forum:confused: OR is it coincidental. i donot know :)
does your dll work on both win98/XP.

drasd_20002

05-06-2003 15:41

I changed the image base from 00400000 to image base when it works in one situation inside IDE. Now it works in all envirinments in a Single OS but not across different OS.
Looks like the OEP is correct because all the functions of the dll are working and no errrors occur once the dll is loaded.

I tried relox - relocation fixer by mact but then it crashes.
dont know how to do it manually Yet. ... have to learn.

may be some experts give a proper hint.

Also when i use revirgin 1.5 "publivc version" enter the oep and click fetch IAt says "found nothing" using IAT resolver gives junk values with 0 references for all. It happens with all apps which are compressed/ crypted.
I can get imports at same oep by imprec . something wrong with that version of revirgin?? or something else.

asterix

05-20-2003 02:57

This is my small example which shows how make patch
for packed DLL by PECompact 1.84.
Enjoy! :D

hxxp://www.exetools.com/forum/showthread.php?s=&threadid=2178

drasd_20002

05-23-2003 15:11

thank U very much.
I will go through it today.
U R great.

All times are GMT +8. The time now is 14:51.

Page 2 of 2

Show 40 post(s) from this thread on one page