#1
|
|||
|
|||
help unpacked .dll now crashes
hello all,
I have a program, that is packed with pecompact, and i unpack it no problem it also has an inported .dll which is also packed, i unpacked that no problem now when i run the app, it loads the unpacked version of the dll but it crashed, in the ModuleEntyPoint code of the .dll prob something i dont understand with PE files, or maybe how its unpacked now there is more sections in the pe file after its unpacked i used UnPECompact2 to unpack it mitch |
#2
|
|||
|
|||
try to unpack dll manually and remember, dll should has relocations
|
#3
|
||||
|
||||
You may try to unpack with QuickUnpack. Try to find out the reason of crash.
|
#4
|
|||
|
|||
I've dumped many PECompact dll's successfully. Any problems have almost always been in the relocations area. If it is a relocations issue search for the great program called "Relox".
1) load .dll into default base address, dump at OEIP, call "dumped_10000000.dll" 2) modify target .dll to new base address, say 0x20000000 (can do this with PECompact targets fine) 3) load .dll again, dump at OEIP, call "dumped_20000000.dll" 4) start Relox, load dump1 in slot1 then dump2 in slot2. 5) Do a compare in Relox and it will rebuild relocations for you 6) Use Relox to add new .reloc section to your "dumped_10000000.dll" Good luck! |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
SoftICE crashes with NVIDIA 81.x/82.x drivers | Kerlingen | General Discussion | 17 | 03-11-2006 15:22 |
Ida2Sice crashes Softice?! | bEaST | General Discussion | 0 | 09-07-2005 22:17 |
Armadillo crashes Olly | Flagmax | General Discussion | 19 | 01-28-2005 09:47 |
OllyScript 0.85 and Olly 1.10 crashes ??!? | Shub-Nigurrath | General Discussion | 6 | 07-11-2004 19:10 |