reply to crusaders reloc issue on rce

Do you mean to say that reloc structure is modifed during loading process??? Are you sure on this?

absolutely! this is how i've dumped many aspr'd dll's. if you're simply loading the dll with ollyloader, then make sure to check 'System breakpoint' in the Events tab under 'Make first pause at:'. then place your bpm.

it works fine unless there is another dll already loaded at that iamge base then it wont load...

that is strange. is it trying to occupy the space of a system dll? cuz then obviously it wouldn't work. if not a windows dll, then is it always the same dll that is hijacking it's native spot?

still tho, with relocs in place it should be assigned a different area to live. i know this is of little or no help, just putting thoughts out there

Darren makes a good point as well