1

Here is my problem:

Program P1 launches another program P2. The P2 program uses a dll DLL1 which is packed using PE Compact. The DLL1 is obviously unpacked during run time and a routine inside DLL1 calls another dll DLL2 which is also packed with PE Compact.

P1->P2->DLL1->DLL2

I have successfully unpacked both the dlls. Now While debugging the OllyDbg shows me "The code is packed, self extracing..." stuff. What I want is to point the OllyDbg towards the unpacked version residing on my filesystem so that a can debug it properly. How do I d this.Thanks in advance :)

1
  • 1
    I'm not sure if I understood you correctly but it seems that you have two original DLLs and those two unpacked on disk. If so, can't you rename the unpacked ones so they are loaded? – user45891 Nov 22 '14 at 15:42
0

As @user45891 commented, replace DLL1_packed on disk with DLL1_unpacked, and replace DLL2_packed on disk with DLL2_unpacked.

(@user45891, feel free to post the same answer as this, and I'll delete my answer so that you can get credit as the "first responder".)

Not the answer you're looking for? Browse other questions tagged or ask your own question.