-
-
隆重推出 DT_FixRes 最终版 -- 最好的 PE 资源修复引擎
-
发表于: 2005-3-13 20:02
-
|
|
|---|---|
|
|
翻译进程就放在这里了
 Translator: cyclotron/TT Introduction: It is a common problem in packed PE files that after unpacking, their resources cannot be viewed or modified by some resource explorers. The main reason for this is that many packers/protectors move the uncompressable resources(eg. Icon,Version information) into the appended section, while most of the resource explorers cannot recognize correctly the resources distributed in two separate sections(except PE explorer, by the way). DT_FixRes is a professional resource rebuilding engine for PE files, capable of recollecting the resources in different sections into a single one, optimizing structures and removing junks if any. Comparable to resource compilers, DT_FixRes restores the resource structures on an almost perfect basis. PE files, when fixed by DT_FixRes, expose the resources to all the resource explorers for free view or modification. The functions of DT_FixRes are accessible to programmers and especially to software localizers through specific intefaces. Disclaimers: 1.DT_FixRes is free for use, subject to the inclusion of copyrights for support to the author. 2.DT_FixRes is presumbly safe to use, but the author holds no responsibility for any damages possibly caused by the engine. Instructions: The engine of DT_FixRes is implemented as a dll, exporting five functions in all, sorted into two types. 1st Type: Restoration of PE resources. When done, the engine will unconditionally append a resource section to the PE file, resulting in an increase in size. These functions apply to simple restoration of unpacked PE files. <1> Export Function Name: FixResFromFile -Prototype for C BOOL __stdcall FixResFromFile(const char* PEFile, char* ErrBuff); -Prototype for Delphi function FixResFromFile(const AFileName: PChar; ErrMsg: PChar): Boolean; stdcall; Arguments Specifications: PEFile --- Pointer to the path of the PE file whose resource is to be fixed; ErrBuff --- Pointer to buffer with the size of at least 80 bytes, for the reception for error messages. This function is compatible with all Win32 platforms. <2> Export Function Name: FixResFromStream -Prototype for Delphi function FixResFromStream(AStream: TMemoryStream; ErrMsg: PChar): Boolean; Arguments Specifications: AStream represents the memory stream of the PE image. Refer to (1) for the others. This function is especially applicable to keygen makers. You may fix the resources by operating the memory stream for a reduction on customized code before dumping the PE image onto your harddisk. Note that it is exclusively compatible with Delphi. 2nd Type: Export of restored resource section. There are various schemes of optimization for dumped PE files due to diversified modifications made to the original PE files by different packers/protectors. The engine provides an oppurtunity to the programmers that they can make customed optimization to the dumped PE files. As the caller, you may be quite acquainted with the best optimization scheme for the specific packer/protector as well as the best starting RVA to load the resource section into. So this function is prepared for the customed requirement. Note that the user should be familiar with PE stuctures on account of the relative complexity of this function. Advanced users only. <1> Export Function Name: DumpResFromFile -Prototype for C BOOL __stdcall DumpResFromFile(const char* PEFile, char* ResFile, DWORD NewRVA, DWord FileAlign, char* ErrBuff); -Prototype for Delphi function DumpResFromFile(const PEFile: PChar; const ResFile: PChar; NewRVA: DWord; FileAlign: DWord; ErrMsg: PChar): Boolean; stdcall; Arguments Specifications: PEFile --- Pointer to the path of the PE file whose resource is to be fixed; ResFile --- Pointer to the path of the exported resource section; NewRVA --- RVA for the PE file to load resource section into, or the virtual address of resource data directory; FileAlign --- File alignment of the resource section, 0x200 or 0x1000 exclusively; ErrBuff --- Pointer to buffer with the size of at least 80 bytes, for the reception for error messages. This function is compatible with all Win32 platforms. <2> Export Function Name: DumpResFromStream -Prototype for Delphi function DumpResFromStream(PEStream: TMemoryStream; const ResFile: string; NewRVA: DWord; FileAlign: DWord; ErrMsg: PChar): Boolean; Arguments Specifications: AStream represents the memory stream of the PE image. Refer to (1) for the others. <3> Export Function Name: DumpResFromStreamEx -Prototype for Delphi function DumpResFromStreamEx(PEStream: TMemoryStream; ResStream: TMemoryStream; NewRVA: DWord; FileAlign: DWord; ErrMsg: PChar): Boolean; This function is especially applicable to keygen makers. You may fix the resources by operating the memory stream for a reduction on customized code before dumping the PE image onto your harddisk. Note that it is exclusively compatible with Delphi. Special tips: The engine restores only the resource of a correctly structured PE file so that please make sure of the validity of the target PE file before calling any of the above five functions. Otherwise, it may result in unexpectable errors. Demo for Delphi: procedure FixResDemo; type TFixPERes = function(const AFileName: PChar; ErrBuff: PChar): Boolean; stdcall; var ErrBuff: array[1..80] of Char; Handle: THandle; FixPERes: TFixPERes; begin Handle := LoadLibrary('DT_FixRes.dll'); if Handle <> 0 then begin @FixPERes := GetProcAddress(Handle, 'FixResFromFile'); if @FixPERes <> nil then if not FixPERes(PChar('ur PE file'), @ErrBuff) then ShowMessage(ErrBuff); FreeLibrary(Handle); end; end; Others: I wrote a demo to test the engine, which located in the same directory as the dll did. Please feel free to inform me of the bugs if any. dREAMtHEATER 2005-03-20 E-mail:NoteXPad@163.com http://dREAMtHEATER.yeah.net |
|
|
告诉你一个小问题，加多层壳就不能用了。
|
|
|
|
|
|
|
|
|
最初由 鸡蛋壳 发布 运用本引擎之前请保证:PE文件已经脱壳,包括多层壳,并且能够正常运行,在这种情况下,理论上都可以正确修复, |
|
|
|
|
|
|
|
|
希望 DT 老大能使 DT_FixRes GUI 对文件拖拽支持，那样就方便多了
|
|
|
最初由 xukl26a 发布 那是我写的demo，而不是完善的工具GUI，只是教你如何应用这个引擎。 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
最初由 dREAMtHEATER 发布 dump功能还差点的说 举个例： 有一壳脱壳后 section 如下： name va vsize offset size .text 1000 1000 1000 1000 .rdata 2000 1000 2000 1000 .data 3000 1000 3000 1000 ……（中间的是垃圾） .rsrc 36000 51000 36000 51000 .pack 87000 2000 87000 2000 .rsrc是资源节，脱壳Dump出来时资源表已经是正常能用资源编辑器浏览，但若我要改 它的RVA 到 31000 就不得了，因为你的DLL只会分析资源结构，总是说正赏，当然不能说不正常，只能说我无法让你的Dll工作，这个工作应该说只调节 里面 item 的 RVA，而无须移动资源。。。这样说你该明白了吧，不明我不知能说什么了... 那资源可是脱壳出来的，属于资源正常，位置不理想 我也写了一篇使用 Dump 功能的文章，如有使用不当，请指教指教。。。
|
