July 5, 200718 yr i have a dump toobt could'tn fix it with imprec ... it says "cant read memory of the process"is there anyone else whoz having the same problem ?? Edited July 5, 200718 yr by nick_name
July 5, 200718 yr var rgn var sz var va GPA "CreateProcessA","kernel32.dll" mov va,$RESULT BP va run BC va rtu mov va,eip add va,76 bp va run bc va sti mov rgn,eax mov va,eip add va,16 go va mov sz,eax eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}" msg $RESULT ret It is better to use PeTools
July 5, 200718 yr var rgnvar sz var va GPA "CreateProcessA","kernel32.dll" mov va,$RESULT BP va run BC va rtu mov va,eip add va,76 bp va run bc va sti mov rgn,eax mov va,eip add va,16 go va mov sz,eax eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}" msg $RESULT ret It is better to use PeTools thanks pavka, nice work ... Edited July 5, 200718 yr by nick_name
July 5, 200718 yr Author Pavka, what OEP do you get? I think your script is wrong because $403B58 is not the OEP The UnPackMe is executed via kernel32.ResumeThread method so don't be tricked in to thinking Pestil EP is real OEP... Ted.
July 5, 200718 yr 4271B0 is oep, no problems using old ebfe trick of changing oep byte at WriteProcessMemory, attach with other olly and dump as raw, change back original oep bytes fix vo = rvo and its done, no other rebuilding required.http://rapidshare.com/files/41159623/dpest.1.0.rar.html
July 6, 200718 yr Thanks zako for your knowledge. Here is a little tip when doing this, or things to not forget. You cant dump with Ollydump, and when editing the oep to ebfe, well when finding it, dont forget to take 1000 off your Oep numbers before adding it to where the buffer starts.
Create an account or sign in to comment