07480A0F Breakpoint at 07480A0F 07480A10 Breakpoint at 07480A10 07490054 Breakpoint at 07490054
OS=x86 32-Bit 07490056 Breakpoint at 07490056 074B0021 Breakpoint at 074B0021 074B0028 Breakpoint at 074B0028
1.681 MB +/-
4.396 MB +/- Dll Can Move Option is Enabled! = Diffrent loading of targetbase! You need to disable this option or system ASLR! Dll Can Move was disabled in PE Header now before dumping later!
Your target is a >>> Dynamic <<< Link Library!
Note: If possible then don't use the VM OEP for dlls if real OEP is not stolen! Change VM OEP after popad to JMP Target OEP! Or Just set a another push 0 before VM OEP push = 2 pushes before jump to WL VM!
OEP change if you want to keep VM OEP for Dll ------------------------------------------------- popad mov ebp, Align push 0 push VM OEP Value jmp WL VM -------------------------------------------------
Exsample: Not stolen Dll OEP! ------------------------------------------------- 100084D2 MOV EDI,EDI 100084D4 PUSH EBP 100084D5 MOV EBP,ESP 100084D7 CMP DWORD PTR SS:[EBP+0xC],0x1 <-- check for 1 must be inside to run the Dll 100084DB JNZ SHORT 100084E2 <-- Don't jump if value 1 is inside stack
Stack: At Target OEP / Not stolen ------------------------------------------------- $ ==> 7C91118A RETURN to ntdll.7C91118A $+4 10000000 Dll_X.10000000 <-- Base $+8 00000001 <-- 1 $+C 00000000
ImageBase in PE keep same = File was loaded with original ImageBase!
PE HEADER: 10000000 | 1000 CODESECTION: 10001000 | 1A000 PE HEADER till CODESECTION Distance: 1000 || Value of 1000 = Normal! Your Target seems to be a normal file!
Unpacking of NET targets is diffrent! Dump running process with WinHex and then fix the whole PE and NET struct!
,感谢分享过程
zzcl558
