Hi there all great reversers!

I wounder if anyone can help my, you see I have a
problem. How do I calculate the end of a program
that is Vboxed?

You see, I like to dump a Vbox app from its OEP and to its end station. When using procdump this is made the dumper, but if I know how to make the calculation I do not have to depend on procdump to save my day.

Hope anyone has the time to replie!
-Ms dec

normally you should use softice with icedump, those are much better
to do some clean job, and even use my tool, revirgin, to rebuild the dumped target's iats.

to calculate the length, just do a map32 command into softice, then you'll see all the sections of it and be able to calculate the length,
you should do a visit to the site's essays about unpacking.

Funny this silly vbox came up, I just looked at an old vbox 4.3 target, and I was unable to get RV or IMPREC to rebuild good IAT...RV never resolved most of the entries, and IMPREC returned VirtualAlloc for most! heh...Its not a complicated redirection scheme, but I guess hard to get around in "general"...Actually, the hydra plugin included w/icedump still works sometimes, but what about future versions =( u guys have any luck w/vbox stuff?

target was derive 5.04 from texas instruments btw

madmax