JFYI Nacho_dj's tool will attempt to rebuild the pe section headers with the sections rebuilt. If the file size is larger than your manual unpacked, you probably are not fully unpacked. Maybe you are only at fake oep where the resource section is repaired/remapped after fake oep. Try editing the resources on your manually unpacked file.
For the R6002 error, you have two options. Leave the sections as is and patch the check like Syoma is referring to or rebuild the section headers. If you manually rebuild the sections, plan on spending much time identifying where the sections are mapped and add/modify the section headers; rebuilding the PE map. Once the code and rdata can have separate permissions you can bypass this check without patching.
more details here. http://forum.exetools.com/showpost.php?p=79880&postcount=16
There is a patcher by manhunter out there that will find and patch the code check if the section is writeable. Never tested it though. ..http://www.manhunter.ru/underground/65_runtime_error_r6002_floating_point_not_loaded.html
btw if rebuilding the sections, might be easier to get the file dumped first then add/modify the sections to the dump.
Last edited by RedBlkJck; 10-29-2013 at 19:13.
Reason: add on
|