Amdumpv62 v2.1 - CondZero [ARTeam] (see history below for details)
Tested under winxp sp2 Should work under w2k, wxp, (maybe vista)
Note: the included pdf overview (from previous release) Still applies to this version with the caveat that import rebuilding is Included in this release for targets that don't use the delayed import Option!!
Info: * new noninvasive loader engine to run & dump activemark v6.2x/6.3x Targets. * run program from its own folder, no need to copy Amdumpv62 to target folder to run. * amdumpv62 will dump activemark v6.2x executables and, if necessary, Rebuild imports automatically for targets with delayed imports Not enabled and finally append the overlay data to the end of the dumped file. Special note: * the import rebuilder will append an '_' suffix to the end of the dumped File. (i.e. dumped.exe >> dumped_.exe similar to imprec). In these cases, the overlay data will be appended to the new dump name Automatically. * sometimes it may be necessary to view the sections in a pe editor Program (i.e. lordpe or similar) because the dumper is Dependant on finding: (4) .text/.text/.code/.code/etc sections in the executable For delayed import targets (3) for non delayed import targets. If (3/4) sections are not found, then the executable may not Be an activemark v6.2x/6.3x application!! * note: also dependent on finding (2) .bss/bss sections in The executable! These sections are used for storing needed data To run dump successfully!
Limitations: * in order to insure the stability of your dumped.exe, it may Be necessary to manually hexedit the dumped file and insert An instruction which moves hi-values to a dword hi-value variable Used in the gettickcount api within the 3rd layer (2nd .text) In the executable. Please refer to the tutorial on dumping And analyzing activemark v6.2x on the [arteam] tutorial Link: http://arteam.accessroot.com/tutorials.html?fid=211
Disclaimer: Not responsible for any damages that result from using this Tool!!
Greetz: Arteam - you're the best!!
History: -------------------------------------------- Amdumpv62 - version 2.1 (July 2008) 1. Updated arteam import rebuilder v1.1.3 (nacho_dj) for targets that don't use the delayed imports option 2. Fix a bug resolving PE header section names
