PDA

View Full Version : Dll rebuild


Sektor
07-02-2006, 05:58 PM
Does anyone know how to rebuild a system dll in rom after exporting it using viewimgfs tool?
I mean that after the exporting I have these files:
imageinfo.bin
imageinfo.txt
S000
S001
S002
S003
S004

...I would like to have xyz.dll.

Thanks.
Bye Sektor

mamaich
09-02-2006, 12:59 AM
I know :)

Just take any PE-editor, take an empty PE-file and insert there these sections while giving them base/RVA/size/etc from imageinfo.txt. And edit PE-header (resources/imports/etc). Of cause you'll get an unworking DLL, but you would be able to decompile it or extract resources.
It is easy to make a program that would automatically reconstruct such DLLs, but I'm too lazy for this.

Sektor
09-02-2006, 09:52 AM
Thanks for your reply.
Can I ask you another little help?

I'm trying to use Ida to decompile my S000 file: when I run it I choose ARM Processor as Processor Type and then it asks me information about ROM and Input file. The info required are:
ROM: ROM start address, ROM size
Input file: Loading address, File offset, Loading size

Using the data in the imageinfo.txt, attached below, I compile the form as following:
ROM start address: 0x01BD0000
ROM size: 0x0004A000
Loading address: 0x01BD1000
File offset: 0x00001000
Loading size: 0x00046158

...but Ida seems to not decompile it correctly.
Could you suggest me a good Pe-Editor?
Thanks in advance.
Bye Sektor

[imageinfo.txt]
Module name: ril.dll
e32_objcnt: 00000004
e32_imageflags: 0000212E
e32_entryrva: 000458FC
e32_vbase: 01BD0000
e32_subsysmajor: 00000005
e32_subsysminor: 00000001
e32_stackmax: 00010000
e32_vsize: 0004A000
e32_sect14rva: 00000000
e32_sect14size: 00000000
e32_timestamp: 5598523F
e32_unit[0].rva: 00045D40
e32_unit[0].size: 00001415
e32_unit[1].rva: 00045C24
e32_unit[1].size: 0000003C
e32_unit[2].rva: 00000000
e32_unit[2].size: 00000000
e32_unit[3].rva: 00049000
e32_unit[3].size: 00000DD8
e32_unit[4].rva: 00000000
e32_unit[4].size: 00000000
e32_unit[5].rva: 0004A000
e32_unit[5].size: 00001000
e32_unit[6].rva: 00001000
e32_unit[6].size: 0000001C
e32_unit[7].rva: 00000000
e32_unit[7].size: 00000000
e32_unit[8].rva: 00000000
e32_unit[8].size: 00000000
e32_subsys: 00000009

o32[0].o32_vsize: 00046155
o32[0].o32_rva: 00001000
o32[0].o32_psize: 00046158
o32[0].o32_dataptr: 20000201
o32[0].o32_realaddr: 01BD1000
o32[0].o32_flags: 60002020

o32[1].o32_vsize: 00000558
o32[1].o32_rva: 00048000
o32[1].o32_psize: 00000558
o32[1].o32_dataptr: 00000000
o32[1].o32_realaddr: 01C18000
o32[1].o32_flags: C0002040

o32[2].o32_vsize: 00000DD8
o32[2].o32_rva: 00049000
o32[2].o32_psize: 00000DD8
o32[2].o32_dataptr: 00000000
o32[2].o32_realaddr: 01C19000
o32[2].o32_flags: 40002040

o32[3].o32_vsize: 00001000
o32[3].o32_rva: 0004A000
o32[3].o32_psize: 00000920
o32[3].o32_dataptr: 10000000
o32[3].o32_realaddr: 00000000
o32[3].o32_flags: 42002042

mamaich
10-02-2006, 01:27 AM
there are lots of PE-editors, for example PEditor. Look at protools.cjb.net