Hi guys,

Could somebody tell me how to unpack a dll form any packer,general theory ?thanks

The FIRST thing to do is read the BIG RED LETTERS at the top of the Forums and then read the FAQ. That will tell you to search for answers BEFORE you post a question.

Go to the search button at the top of the Forums and enter "unpack dll" (without the quotes) and read the many threads you will find with that search.

Regards,

it works the same way as a executable... you can use a PE Editor to change characteristics that windows don't think it is a dll and then execute it or use ollydebug. i think it's better to change characteristics. then unpack as usual

you can use a PE Editor to change characteristics that windows don't think it is a dll and then execute it

exaclty which characteristics to change?? and what values to change for ?

for DLLs, you have to subtract 2000 from characteristics to make windows think it is an executable.

example:
characteristic of DLL: 210E
- 2000 = 010E

windows will think it is an executable. of course it is only for unpacking. the dll itself won't run. after unpacking, change characteristics back or dll won't work

@Crk
characteristics in PE Header

thanks for the info will try it out

could you tell me how to do it exactly ?thanks a million

That's an excellent idea, never thought of that approach

No.

Or to elaberate on dELTA's, somewhat cryptic response, that's why the Diety inventy the internet. So that you could search the net and find information about things you don't know how to do. Why heck, you could even try SEARCHING for an answer HERE. There is a search button here, don't ya know???

Using the words: "PE Editor change characteristics" (without the quotes) you should find some interesting reading about PE headers and at least a couple of kinds of "characteristics" one might change.

These is also alot of information on the net about the PE file format you probably should become familiar with if you intend to actually learn how to unpack.

Regards,

Ok thank you for the replies ,i will surely do that .

nice tips on the .dll > exe MarKUS

can load dll in olly now

Somtimes it is necessary to load the dll for unpacking without any changes,
because of CRC selfchecking. For this approach I usualy do a small program
with LoadLibrary() function inside, then a famous Spl/\js 'BPX ORD_0056+94'
breakpoint under win98 will do a job (or "Break on new module" under Olly?).
Neviens.