Just when I was getting cocky about my armadillo abilities, I'm suddenly thrust back to my status as a dumb questioner!
I'm unpacking a program with nanomites and when I try to repair the dump in the very last step, Arminline tells me it can't do it and to "try removing armadillo's residual section" I know exactly what it means, but alas, I only know how to NOP or fill with zeros. I know this is an easy one step procedure. Can any of you mavens of cracking tell me what it is?
BTW As I was lookin for a way to remove sections, I right clicked in the Memory window and there was a coomand to "actualize" . It doesn't remove armadillo sections, but as long as I've got your attention, does anybody know what this does?
It would be interesting if you would show in some detail how you do it with lpe, I've never ended up with a working dump after removing sections and rebuilding dumped arma targets using lpe alone. My method is, using ollypedumper dump twice, first a full dump all sections included, second one with all sections from the second .text to end removed, extract the resource section from first dump, use resource rebuilder to rebuild resources then add it to the second dump, that always works but a easier/simpler method would be preferred.
I think that I wrote in couple mines tutorials how to do it. You erase all sections of armadillo that are unused. But if you redirect spliced code to one of them, then ofcourse that you must not delete it. Sometimes is not good to delete that .pdata one.
When you delete sections the easiest way is to rebuild it with LordPE. But in options select only "Validate PE file" and "Show Progress Window". If you want to do it manually, then you must set number of sections and image size. Also you can check file alignment, sections , etc...
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum