|
RelocationRebuild
RelocationRebuild:
build relocations for a PE file
First step is selecting dumped exe/dll in "File Name"
then we you have two options:
1. Dasm Search button - not always working
2. Search button
this also tries to compare it if selected Process/Module is chosen
you could also leave Process/Module empty and proceed with Search button
and compare afterwards the resulted list and remove wrong elements by pressing:
A. Check process button - this uses the Process/Module chosen
B. Compare with file - select a file
The process or filename should have other ImageBase then the one from "File Name".
The final step is "Append to PE" to finally build relocations.
|