Log in

View Full Version : PECOMPACT packed dll(1.6 - 84)


asd
May 2nd, 2003, 13:05
I was trying to unpack/inline patch a dll treated as above.

I found the oep and suspended the dll at OEP in SICE using IECEXT. I tried to rebuild the import table with Imprec.

Now the dll is working in certain environment like if it is the first dll called from the prog. It doesnot work on different comptuer or diff OS(win 98) or its 3rdc alled dll etc.. I worked in Xp.

what could be cause. Relocs ?

Plz help me with suggestions.


____________________________________________
Edit : exetools forum wass down ; I had discussed about this there earlier. Please tell me if I violated rules I'll correct myself

S3ri@l CoDe9x
May 3rd, 2003, 05:54
.. The IAT redirection in Win 98/ME ... Itīs diferent to 2k/XP

I had this problem to the cracking a program with aspr.. (DzSoft PHP Editor 1.2)


It was simple only i Nop one call and this work wonderful in
win 9x/Me

But i have 2 .EXE's ..One for XP /2K and One for 9x/ME


If your problem is that the program remains in memory or simply it doesn't work

U need to rebuild the IAT directly in one win 9x/ME

i hope help u


Best Regards!

asd
May 3rd, 2003, 22:34
yes it remains in memory and doesnt work- somrtimes error messges. I see that 98 dumped vesion works only in 98.
building IAT on Xp dumped version in 98 doesnt help.

further the problem is if the dll calling order is different it wont work.

Can i not modify the unpacked dll such that it works all platforms - else unpacking would be sort of incomplete.
any clues -- I will explore

S3ri@l CoDe9x
May 4th, 2003, 03:03
"It doesnot work on different comptuer "

i read again your past post .. for this i only have one question..


U verified if your method for dumped it's correct?


We go!!..Pe Compact it's not complicated... ..


Maybe .. rebuild IAT it's not the problem


Best Regards!

asd
May 5th, 2003, 01:20
Sorry it didnt work intially i dont know what was wrong.
i chacked the last dump at same oep works on any computer (3) checked but with same os.(98/me or xp) not checked 2000.

asd
May 6th, 2003, 02:51
I changed the image base from 00400000 to image base when it works in one situation inside IDE. Now it works in all envirinments in a Single OS but not across different OS.
Looks like the OEP is correct because all the functions of the dll are working and no errrors occur once the dll is loaded.

I tried relox - relocation fixer by mact but then it crashes.
dont know how to do it manually Yet. ... have to learn.