Log in

View Full Version : Bad address references in a dumped encrypted dll

theraptureback
November 16th, 2003, 06:19
Hi all.
i'm trying to reverse a PACE INTERLOK protected dll.
When i dump it (with procdump) the offset of import fuctions seems corrupted

original code:
call [GobalAlloc]
dump code:
call [bb3ee100]

and maybe the global vars too...

I try rebuilt the IT with ImportREC but no luck.

any1 can say me whats is the problem and how i can resolve it

very thnx and nice to meet all

the^rapture
dELTA
November 16th, 2003, 06:23
Rebuilding the IAT of a dumped exe/dll is often a little more work than just a single click in one of those auto-rebuilding programs. You will find lots of info about it by searching this board anyway.
prejker
November 17th, 2003, 11:05
u prolly have bad relocations. use mact's awesome ReLoX to fix them, its on his site
Liquid
November 18th, 2003, 09:23
Quote:
[Originally Posted by prejker]u prolly have bad relocations. use mact's awesome ReLoX to fix them, its on his site


Jeeeez, prejker. So you're still alive ;-)
prejker
November 23rd, 2003, 16:14
Quote:
[Originally Posted by Liquid]Jeeeez, prejker. So you're still alive ;-)


yea... alive and kickin'
Woodmann
November 23rd, 2003, 21:47
Quote:
Jeeeez, prejker. So you're still alive ;-)


It is nice to see you active again

Woodmann