View Full Version : Dll rebuild
Sektor
07-02-2006, 05:58 PM
Does anyone know how to rebuild a system dll in rom after exporting it using viewimgfs tool?
I mean that after the exporting I have these files:
imageinfo.bin
imageinfo.txt
S000
S001
S002
S003
S004
...I would like to have xyz.dll.
Thanks.
Bye Sektor
mamaich
09-02-2006, 12:59 AM
I know :)
Just take any PE-editor, take an empty PE-file and insert there these sections while giving them base/RVA/size/etc from imageinfo.txt. And edit PE-header (resources/imports/etc). Of cause you'll get an unworking DLL, but you would be able to decompile it or extract resources.
It is easy to make a program that would automatically reconstruct such DLLs, but I'm too lazy for this.
Sektor
09-02-2006, 09:52 AM
Thanks for your reply.
Can I ask you another little help?
I'm trying to use Ida to decompile my S000 file: when I run it I choose ARM Processor as Processor Type and then it asks me information about ROM and Input file. The info required are:
ROM: ROM start address, ROM size
Input file: Loading address, File offset, Loading size
Using the data in the imageinfo.txt, attached below, I compile the form as following:
ROM start address: 0x01BD0000
ROM size: 0x0004A000
Loading address: 0x01BD1000
File offset: 0x00001000
Loading size: 0x00046158
...but Ida seems to not decompile it correctly.
Could you suggest me a good Pe-Editor?
Thanks in advance.
Bye Sektor
[imageinfo.txt]
Module name: ril.dll
e32_objcnt: 00000004
e32_imageflags: 0000212E
e32_entryrva: 000458FC
e32_vbase: 01BD0000
e32_subsysmajor: 00000005
e32_subsysminor: 00000001
e32_stackmax: 00010000
e32_vsize: 0004A000
e32_sect14rva: 00000000
e32_sect14size: 00000000
e32_timestamp: 5598523F
e32_unit[0].rva: 00045D40
e32_unit[0].size: 00001415
e32_unit[1].rva: 00045C24
e32_unit[1].size: 0000003C
e32_unit[2].rva: 00000000
e32_unit[2].size: 00000000
e32_unit[3].rva: 00049000
e32_unit[3].size: 00000DD8
e32_unit[4].rva: 00000000
e32_unit[4].size: 00000000
e32_unit[5].rva: 0004A000
e32_unit[5].size: 00001000
e32_unit[6].rva: 00001000
e32_unit[6].size: 0000001C
e32_unit[7].rva: 00000000
e32_unit[7].size: 00000000
e32_unit[8].rva: 00000000
e32_unit[8].size: 00000000
e32_subsys: 00000009
o32[0].o32_vsize: 00046155
o32[0].o32_rva: 00001000
o32[0].o32_psize: 00046158
o32[0].o32_dataptr: 20000201
o32[0].o32_realaddr: 01BD1000
o32[0].o32_flags: 60002020
o32[1].o32_vsize: 00000558
o32[1].o32_rva: 00048000
o32[1].o32_psize: 00000558
o32[1].o32_dataptr: 00000000
o32[1].o32_realaddr: 01C18000
o32[1].o32_flags: C0002040
o32[2].o32_vsize: 00000DD8
o32[2].o32_rva: 00049000
o32[2].o32_psize: 00000DD8
o32[2].o32_dataptr: 00000000
o32[2].o32_realaddr: 01C19000
o32[2].o32_flags: 40002040
o32[3].o32_vsize: 00001000
o32[3].o32_rva: 0004A000
o32[3].o32_psize: 00000920
o32[3].o32_dataptr: 10000000
o32[3].o32_realaddr: 00000000
o32[3].o32_flags: 42002042
mamaich
10-02-2006, 01:27 AM
there are lots of PE-editors, for example PEditor. Look at protools.cjb.net
vBulletin® v3.7.4, Copyright ©2000-2009, Jelsoft Enterprises Ltd.