View Single Post
  #3  
Old 10-29-2013, 18:59
RedBlkJck RedBlkJck is offline
Family
 
Join Date: Oct 2011
Posts: 99
Rept. Given: 64
Rept. Rcvd 80 Times in 43 Posts
Thanks Given: 25
Thanks Rcvd at 11 Times in 9 Posts
RedBlkJck Reputation: 80
JFYI Nacho_dj's tool will attempt to rebuild the pe section headers with the sections rebuilt. If the file size is larger than your manual unpacked, you probably are not fully unpacked. Maybe you are only at fake oep where the resource section is repaired/remapped after fake oep. Try editing the resources on your manually unpacked file.

For the R6002 error, you have two options. Leave the sections as is and patch the check like Syoma is referring to or rebuild the section headers. If you manually rebuild the sections, plan on spending much time identifying where the sections are mapped and add/modify the section headers; rebuilding the PE map. Once the code and rdata can have separate permissions you can bypass this check without patching.

more details here. http://forum.exetools.com/showpost.php?p=79880&postcount=16

There is a patcher by manhunter out there that will find and patch the code check if the section is writeable. Never tested it though. ..http://www.manhunter.ru/underground/65_runtime_error_r6002_floating_point_not_loaded.html

btw if rebuilding the sections, might be easier to get the file dumped first then add/modify the sections to the dump.

Last edited by RedBlkJck; 10-29-2013 at 19:13. Reason: add on
Reply With Quote
The Following User Gave Reputation+1 to RedBlkJck For This Useful Post:
giv (10-29-2013)