0

I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe.

I think I've reached the OEP 0x3DADDD (the memory location of the unpacked code has been allocated with VirtualAlloc), When I'm trying to dump the unpacked code with OllyDumpEx I get the LOADDLL.exe sections and not the unpacked dump file sections (The dumped file is LOADDLL.exe), How can I dump the unpacked code and fix imports? OEP + OllyDumpEx Thanks.

1 Answer 1

1

I would recommend using the starting address of the lpbuffer from WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) : enter image description here After that if needed you can fix the IAT table with a tool like: Scylla

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.