yep no probs progopis...give me rough copies and ill make it so its nice and fluent
...even if u just did copy n paste your russian into a russian-english translator ill fill the gaps bro no probs and we'll have all the tuts in english!
progopis...im newbie at unpacking so..
think i managed to sort out the TLS table
ie..orig dumped.exe when loaded into lordPE listed TLS=007999F0, bytes at that location = 00D0B200B4D0B2
the newer dumped file with 2 sections removed showed those bytes at location 0072e00
so in lordePE i changed TLS=007888FO >0072E00 that right?
i then tried sorting the .relocation addresses but couldnt find the bytes referred to in original dumps .relocation address...those bytes are 0020000008 which means when i deleted 2 sections i also deleted those bytes...if i leave the section containing those bytes in then theres no point changing TLS and relocations addresses coz there already correct...obviously im doing something wrong or missing something..
i carried on anyway and dumped .rsrc section from the orig dumped.exe using lordPE but found out theres no way to add or merge that section using resource binder?? binder i found is v2.3 and it only allows 2 things..load an exe and recover..no choices to load or choose a section etc ??
also i know my targets oep is 00401684 but script...."Repair IAT and APIs calls.osc" ie..one i use to make dump gives me oep 0173027C
obviously ill need to read more and itll be great when i can read vnekrilov's tutorials in english
my target has 11 sections
00400000 00001000 target PE header Imag R RWE
00401000 00499000 target code Imag R RWE
0089A000 00293000 target code,data Imag R RWE
00B2D000 00001000 target code Imag R RWE
00B2E000 00001000 target code Imag R RWE
00B2F000 00003000 target code Imag R RWE
00B32000 00003000 target code,exports Imag R RWE
00B35000 00008000 target .rsrc code,resources Imag R RWE
00B3D000 0005C000 target code Imag R RWE
00B99000 00029000 target .data code,imports,relocations Imag R RWE
00BC2000 00001000 target .adata code Imag R RWE
010CC000 00001000 Priv RW Guar RW
010CD000 00003000 stack of main thread Priv RW Guar RW
010D0000 00009000 Priv RW RW
015D0000 00167000 Map R E R E
019AF000 00021000 Priv RW Guar RW
what ones do i remove??
ps..when i couldn't find the relocation "bytes" after deleting sections from orig dump i created a new section and added the bytes manually but still nowhere near a working dump lol
bunion