Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #11  
Old 02-12-2004, 01:42
Wurstgote
 
Posts: n/a
@ britedream:
You turned my attention to another aspect of ASPR, thanks for that! Later I will have a look at the thread mentioned by SatyricOn.

@ SatyricOn:
Quote:
Remember, all sections after .rsrc (including .adata and .data) should be deleted entirely
Yes, I know. I'm afraid this will be another long, long evening... *sigh*
Quote:
after you have relocated any useful data out of them.. hint, hint
Hmmm... so the first thing I should do is figuring out what data is needed and what data is trash.
So far I know that the data in .mackt is needed since it contains the IAT. That mean I need to find a way to store the IAT entries somewhere else.
Quote:
This would not be good.. The BSS section is used at runtime by Delphi (remember that data morphing again?), so your import table would be overwritten at runtime. Which wouldn't be a good thing....
Perhaps my explanation of what to do with .mackt was kind of rubbish (sorry for that, English is not my native language )
I thought of using only the _disk_ space at offset 226000 to store the .mackt part, but without changing the virtual offset of the .mackt section. While loading the app, the loader would see that the section located at file-offset 22600 should go to VA 313000 in memory, so the section at VA 22600 isn't occupied and Delphi can use it for whatever it wants.
Quote:
FYI, the DATA section is for initialized data, the BSS section is for uninitialized data (namely, the data is initialized at runtime).
Ahh... good thing to know Thanks!

Regards
Wurstgote
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
one newbie question SubzEro General Discussion 7 03-12-2015 06:05
ASPR, ARMA question sgdt General Discussion 3 04-09-2006 03:38
ASPR 1.2 question gabri3l General Discussion 42 05-01-2004 15:09
a newbie question about CRC32 abccc General Discussion 13 04-23-2004 03:13
"newbie" question for crackers ;) newbie007 General Discussion 4 10-07-2003 04:46


All times are GMT +8. The time now is 08:14.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )