Quote:
|
Originally Posted by Frequency
hey
in your options..
make sure this is unticked " use PE Header from disk"
otherwise then yes you pick up the 004xxxxx instead of 35xxxxxxx ..
i just tried it.. and it picks up base...
|
Well,Thank you very much.I got it.
I always learn so much from ARteam.You did very well.
--------------------------
Quote:
|
Originally Posted by adaptor
You probably need to change ImageBase in PE header of dumped dll to 003B0000
|
Yes,you are right.
There is a crash when I fixed the Import table.
But I found the cause:the imagebase of the dumped dll is still 00400000.
I should be 003B0000.
I corrected it with lordPE.It works.
If you donnot want to do so.
When you dump the dll,You could tick the "Full dump:Rebuild Imagebase"
and make sure tick "change Imagebase to" and set it to 003B0000.
That's it.
Thanks again.
Regards