BlackB
February 26th, 2001, 08:23
I practised using ReVirgin on notepad.....and that was no problem. Everything worked fine. But notepad is a too "everything-goes-fine" example program. It would be better if a little essay was written on how to unprotect Commview.
Anyway......here are some things that are not clear from TSehp's readme.txt:
-"IT.bin : the import table file generated after the trace, I choosed to put it at offset 0xe8d0 so this value was set on revirgin..."
This is not a really clear sentence. If I read this I wondered: Why did you choose offset E8D0 ? So I started to look in a PE-editor and E8D0 was the IT RVA. Great! So I succeed without too much trouble in unprotecting Notepad.
My next target....Commview v2.4. "Let's try this myself now", I thought.
Successfully found IAT RVA, Length, IT RVA. Now, the IT RVA is 12E12C as can be found in a PE-editor......but.....when looking at the dumped Commview, there is no such offset 12E12C. Okay, probably because it's a Relative Virtual Adress, right?
Now my question is.....what do I have to do to make this work? Add a new section with raw offset 12E12C and thus extend the dumped file with several bytes? Or should I search for another location in the dumped file that can be used. If so, how can I find such a location?
For these questions I've read the essay Kilby wrote....but that still didn't gave me any clarity on the case: He said that the IT RVA==761F8. Okay, then he writes:
"Starting at 741F8 highlight 1964 bytes (for that is the length of SSIT.BIN), and choose Replace with file, and choose SSIT.BIN.
Why not 761f8, well look at the section information, particularly at the Virtual & Raw Offset fields, on the .data and .rsrc sections."
Well, that's great Killby, but it appears to be that I do not own the game SuddenStrike, and that I just can't download a whole CD-ROM. It would be good if you explained why you choose 741f8 and not the most logical 761f8.
Then he writes:
"After saving this change, choose PE Editor in procdump and open ssdumped.exe and go into Directory and change the following fields:
Import Table Length
000761F8 000000CC"
Okay, now I'm totally lost.....if you just said you put the IT at 741f8 then why tell the PE the importtable is at 761f8 ??
There's also never mentioned (not in tsehp's readme or killby's essay) that other things, like raw-offset/virtual-offset should be aligned. Now, I know this, but I'm sure that many people who use ReVirgin for the first time, or just learn to unpack, know this.
Any two of you volunteer to write a detailed, easy-to-understand essay on CommView v2.4? I suppose not :P heheh, but some answers to my questions would be greatly appreciated. I bet they can help thousand other people too :P
greets
The Blackbird aka BlackB
Anyway......here are some things that are not clear from TSehp's readme.txt:
-"IT.bin : the import table file generated after the trace, I choosed to put it at offset 0xe8d0 so this value was set on revirgin..."
This is not a really clear sentence. If I read this I wondered: Why did you choose offset E8D0 ? So I started to look in a PE-editor and E8D0 was the IT RVA. Great! So I succeed without too much trouble in unprotecting Notepad.
My next target....Commview v2.4. "Let's try this myself now", I thought.
Successfully found IAT RVA, Length, IT RVA. Now, the IT RVA is 12E12C as can be found in a PE-editor......but.....when looking at the dumped Commview, there is no such offset 12E12C. Okay, probably because it's a Relative Virtual Adress, right?
Now my question is.....what do I have to do to make this work? Add a new section with raw offset 12E12C and thus extend the dumped file with several bytes? Or should I search for another location in the dumped file that can be used. If so, how can I find such a location?
For these questions I've read the essay Kilby wrote....but that still didn't gave me any clarity on the case: He said that the IT RVA==761F8. Okay, then he writes:
"Starting at 741F8 highlight 1964 bytes (for that is the length of SSIT.BIN), and choose Replace with file, and choose SSIT.BIN.
Why not 761f8, well look at the section information, particularly at the Virtual & Raw Offset fields, on the .data and .rsrc sections."
Well, that's great Killby, but it appears to be that I do not own the game SuddenStrike, and that I just can't download a whole CD-ROM. It would be good if you explained why you choose 741f8 and not the most logical 761f8.
Then he writes:
"After saving this change, choose PE Editor in procdump and open ssdumped.exe and go into Directory and change the following fields:
Import Table Length
000761F8 000000CC"
Okay, now I'm totally lost.....if you just said you put the IT at 741f8 then why tell the PE the importtable is at 761f8 ??
There's also never mentioned (not in tsehp's readme or killby's essay) that other things, like raw-offset/virtual-offset should be aligned. Now, I know this, but I'm sure that many people who use ReVirgin for the first time, or just learn to unpack, know this.
Any two of you volunteer to write a detailed, easy-to-understand essay on CommView v2.4? I suppose not :P heheh, but some answers to my questions would be greatly appreciated. I bet they can help thousand other people too :P
greets
The Blackbird aka BlackB