What I know:

It is hard to patch the unpacked executable though may be not impossible. I tried dZa Patcher, worked on my PC but not on others. Aspatch said "not enough space at the end".

What I don't kow:

Do RVAs change from PC to PC? Both the disassembler (unpacked) and sice (packed) shows the same code at any specific RVA of the executable. So where is the problem? Neither patcher nor loader work except on my PC. I'm confused.

Are there any loaders that will do S&R job on "packed" executables? I couldn't find one.

Any comment greatly appreciated.

Hi,

Different operating systems affects the loader or patched file.
example win98 notpad doesn't runs in win95 unless you have fixed i.t and iat...

That's for sure.

Any specific answer about the RVA stuff?

hi,

for already unpacked progs, there is no need to use a loader. Just patch the unpacked exe/dll files directly.

To patch packed ones, one way is using a loader, the other is SMC(self-modified code).


The RVAs of instructions/data in Win32 EXE/DLL never change, so does the ImageBase of EXE. But the ImageBase of DLLs may change(relocation occurs), so the VA of DLLs may also change (VA = ImageBase + RVA).