DeepBlueSea
August 10th, 2008, 09:58
I am dealing with a Dll here (nvoglnt.dll), of which the code in the code section is altered BEFORE DllMain is executed, BEFORE IAT Entries are resolved and even before relocations happened.
I am breaking directly after ZwZwMapViewOfSection, after the Dll was mapped into memory, and then i look at certain places in the code-section and they are completely different from the exact place in the file image.
How can this be?
This Screenshot might explain what i exactly mean [1].
And i see that the original code doesn't make much sense either (eg. address 0xBEEFBEEF) so it has to be modified somehwere. But what possible fixups could that be? Does the Loader have something to do with it?
I hope someone has an idea, what happens here.
[1] http://www.abload.de/img/nvoglntv2s.png
I am breaking directly after ZwZwMapViewOfSection, after the Dll was mapped into memory, and then i look at certain places in the code-section and they are completely different from the exact place in the file image.
How can this be?
This Screenshot might explain what i exactly mean [1].
And i see that the original code doesn't make much sense either (eg. address 0xBEEFBEEF) so it has to be modified somehwere. But what possible fixups could that be? Does the Loader have something to do with it?
I hope someone has an idea, what happens here.
[1] http://www.abload.de/img/nvoglntv2s.png