tribal
06-29-2008, 06:15 AM
Hello,
Im trying to rebuild a protected .net assemby. I think the protection used is reactor but im not sure about that.
I unpacked the assembly using ollydbg and try to rebuild the PE header using the way described by the video tutorial from rongchaua.
I rebuilded the MetaData RVA and the MetaData Size. It looks like this went OK, the errors disapeard and I can open the metadata streams now.
I fixed the NT file header (removed the checked "this is a dll file" thing) and saved the exe.
WHen i try to launch the "fixed" exe it says: "cant initialise the application (0xc000007B)" (i get the message in dutch, so the translation is not 100% accurate).
I guess it points to an invalid memory address somewhere, but i got no clue how to fix this.
In the zip file is the unfixed dump from olly and the exe i tried to fix but doesnt work.
What am I doing wrong and how can I fix this exe? (note: im noob in reversing)
link to zip: here (http://ifile.it/p72z1xk)
Im trying to rebuild a protected .net assemby. I think the protection used is reactor but im not sure about that.
I unpacked the assembly using ollydbg and try to rebuild the PE header using the way described by the video tutorial from rongchaua.
I rebuilded the MetaData RVA and the MetaData Size. It looks like this went OK, the errors disapeard and I can open the metadata streams now.
I fixed the NT file header (removed the checked "this is a dll file" thing) and saved the exe.
WHen i try to launch the "fixed" exe it says: "cant initialise the application (0xc000007B)" (i get the message in dutch, so the translation is not 100% accurate).
I guess it points to an invalid memory address somewhere, but i got no clue how to fix this.
In the zip file is the unfixed dump from olly and the exe i tried to fix but doesnt work.
What am I doing wrong and how can I fix this exe? (note: im noob in reversing)
link to zip: here (http://ifile.it/p72z1xk)