Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #5  
Old 10-29-2013, 23:05
TempoMat TempoMat is offline
Friend
 
Join Date: Jan 2006
Posts: 89
Rept. Given: 10
Rept. Rcvd 6 Times in 6 Posts
Thanks Given: 4
Thanks Rcvd at 28 Times in 21 Posts
TempoMat Reputation: 6
Quote:
Originally Posted by giv View Post
Other solution.
Compress the unpacked file with UPX and it will work.
Tried this as well but UPX could not compress the unpacked exe.
Quote:
Originally Posted by RedBlkJck View Post
Maybe you are only at fake oep where the resource section is repaired/remapped after fake oep. Try editing the resources on your manually unpacked file.
No the OEP in both files are the same.

Quote:
Originally Posted by giv View Post
]
Search this patter #C1E81FF7D083E001#
--------------------------
MOV EAX,DWORD PTR DS:[EAX+24] ; Section char of codesec to eax
SHR EAX,1F
NOT EAX
AND EAX,1
The breakpoint at the location 00541C17 (with the quoted pattern) is hit continuously.
If I set EAX=1 after the AND EAX,1 instruction at the first hit, the unpacked file runs without the error. All other hits will trigger the R6002 error and some other SEHs with EAX modified to 1. So patching here will have to be thoroughly thought of.

Maybe trying to rebuild the peHeader first before dumping might be the most elegant way even though it could be the most time consuming option.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
WinCE Floating-Point operators - HELP leader General Discussion 0 01-31-2018 03:18
Runtime Error R6002 - Floating point not loaded MrGneissGuy's General Discussion 1 09-14-2009 03:08
reverse engineering floating point code jonwil General Discussion 3 11-04-2008 09:08


All times are GMT +8. The time now is 18:19.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )