|
#32
14-09-2006, 01:51
|
||||
|
||||
|
which is why you should stop being a tool monkey and code your own dumper
__________________
bleh DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you... 
|
|
#33
14-09-2006, 02:52
|
||||
|
||||
|
Well, you should at least check 'Renormalize imports' to ensure support on Win98, dunno about the other stuff.
If FirstThunk is right, everything should work fine. To be a bit more sure check 'Rebuild Original FT', so OFTs are availible as well. I'd never try bound imports which causes more problems than the 'normal' ones... A new section including a new built IAT is also not a bad idea, if you ask me, I always use it when fixing ASPro or Arma. When I fix Import Elimination thingie with the "unreadable IAT" with my script, I need that option anyway... 
|
|
#34
14-09-2006, 04:22
|
|||
|
|||
|
@TippeX: I like being a Tool! Not sure about the monkey bit though
 Anyway, it doesn't matter whether you use someone elses tool or one you coded yourself, it's still being a tool monkey I'm not a coder anyway so, it's really difficult to get to grips with this, not seen many tutes and those I have are too technical and assume lots of prior knowledge. I know just how difficult learning this stuff is, and some of it is really scary. @Muji-FightR: Tried those settings on a Win98/XP target but still no go under Win98, XP still works though. You know somethings wrong because of RestoreLastError popping up but fixing that didn't help, so me knowing something substantial about Kernel API's, PE files and IAT would help  Well, this isn't a coding topic, so let's just see if anyone else can get that EXE to work on their XP systems!
|
|
#35
14-09-2006, 12:04
|
||||
|
||||
|
IAT/Import Table isn't hard whatsoever, kind of weird, but if you take yourself about half an hour of reading, most of it should be clear...
This knowledge isn't always needed, but it can make things way easier... I already wrote a tutorial about the import section which took me 3 hours to write... well, it's pretty hard to describe all that  And you cannot just "learn" Kernel APIs, it's more of getting info on the way, by reading tuts along with some small hint about this API etc., except you're coding... I always came along w/o coding knowledge, tried my skills at C++. but I'm not good at PHP either, so wtf should I be good at in C++ lol So far Ollyscript always did the job for me 
|
|
#37
14-09-2006, 13:41
|
|||
|
|||
|
Quote:
__________________
Sanity is for the weak.
|
|
#38
14-09-2006, 15:53
|
|||
|
|||
|
Quote:
@Muji-FightR: I have read some info on Import Table, parts make sense but some don't. I also noticed one thing that may be wrong with my dump, image base of the new IAT. Most programs I've looked at have the IAT under 0x00100000 and mine ends up at 0x00490000 (maybe screwing the Win9x compatibility in other dumps?).
|
|
#40
14-09-2006, 22:26
|
|||
|
|||
|
Actually, I do not have that update installed. KB917422 I mean. I heard before that I should not install it.
__________________
You got jack and shit, and jack left town.
|
|
#41
14-09-2006, 22:53
|
||||
|
||||
|
image base of the new iat? huh?
only the executable has an image base.. the iat is baseless, what you mean is its va.. and the va of the iat can change, provided the import table itself (the part which gets filled with the va's of all the lovely api's) remains the same.. no fixups required then... if it changes then you have lots of fixups to do for practically every ff 25 / ff 15 in the exe.. fun fun fun
__________________
bleh DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you...
|
|
#42
15-09-2006, 00:17
|
||||
|
||||
|
If I understood you right, you can just check 'Create new IAT' in ImpRec, it should patch the Call / Jmp Dwords (ff15/25) to the newly created IAT which resides inside the .mackt section...
Guess with base of IAt he means the beginning...
|
|
#43
15-09-2006, 02:39
|
||||
|
||||
|
hmm but theres multiple iat's in the dump...
one from the initial wrapper, and one from the 'virgin' executable, so changing the ff 15 / ff 25 stuff can be very error prone, unless a 'merged' iat is used, and then you have the dilema of it actually accurately patching a real call/jmp and not fpu code or something similar (easiest way i do for that is check alignment, opcode length, bytes preceeding the ff 15 / ff 25 etc..) gets very tricky, for some prots
__________________
bleh DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you...
|
|
#44
15-09-2006, 05:13
|
|||
|
|||
|
@TippeX: I think I meant it's image as in memory, meaning it's address in memory as you've pointed out. There's probably some sections that can be removed, but then it means cleaning up the dump so it still works, which is beyond me.
Sorry it doesn't work for anyone else but me, a consequence of dumping/fixing on my own system I guess
|
 |
| Thread Tools | Search this Thread |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Fear Can't Update | Someotherguy | PC Games | 1 | 13-08-2006 22:20 |
| Need Diablo2 1.06 No-CD for B.net | Sergius2k | Multi Player Games | 3 | 17-05-2001 02:10 |
| can anybody help with patching fear effect 2(uk)? | vizz | PSX Games | 1 | 03-05-2001 13:41 |
| Robsoft Diablo 2 1.06 .exe fix doesn't work? | Mikus11 | PC Games | 0 | 26-04-2001 09:23 |
| FEAR EFFECT 2 (PAL) | IDUNNO | PSX Games | 4 | 22-04-2001 04:12 |
Linear Mode
