PDA

View Full Version : Extracting DLL from Toshiba e740 ROM


sirfred
15-02-2006, 09:40 PM
First of all, excuse me, because this surely can be considered offtopic, but I'm getting desperate.

The problem is that I need to extract the DDI.DLL file from a Toshiba e740 ROM, I found the dumprom.exe utility that is using the same file in the examples of use that the one I'm trying to extract ddi.dll from:
nk-e740-1.0618.0409.bin

I'm not sure about the version of this ROM, but I think it's a PocketPC 2002 version. When I just invoke:
dumprom.exe -d rom nk-e740-1.0618.0409.bin
I'm just getting lines with the text:
error decompressing xxxxxxxxxxxxxxxxxxxxxx

When I use the '-3' flag, I got none of those errors, and I have a DDI.DLL file (and a lot of other files), but is unusable for disassembling in Ida Pro. It seems that some sections are corrupted or not correctly extracted. For example, the rva for the exported functions seems not to be present. Anyway, looking for ASCII strings, I'm able to find the names of all the functions in some locations of the file.
When I try to get some info with peinfo.pl, for example, it dumps me the error:
cannot find rva 0001d7b0 for exporttable
Another extracted files seem to be fine, and at least I'm able to see the export table.

What's the problem? Is this just what I have into the ROM, or perhaps I'm missing something or is dumprom.exe failing for this ROM?

Excuse me for posting here with an actually not related XDA problem, but this is the only resource I've found that seems to give me some hope to go ahead.

Regards and thanks a lot for reading me.

mamaich
16-02-2006, 01:29 AM
Probably dumprom is incompatible with such old OSes. You can manually set RVA and other addresses in a dumped DLL, or modify its sources.

sirfred
16-02-2006, 07:44 PM
Anyway, I'm not getting significant errors while executing with '-3'. The only strange messages are:

ERROR: could not find pointer for ofs 00000000

and some:

addr1 - addr2 Llen unknown some values here

And also some:

addr1 - addr2 Llen NUL

Are these actually errors, fatal errors, or just warnings?

Talking about setting rvas manually. How could I tell what RVA values should I use? Is there any information available about doing such a thing?

Thanks a lot.

mamaich
17-02-2006, 12:49 AM
Talking about setting rvas manually. How could I tell what RVA values should I use? Is there any information available about doing such a thing?Al; information regarding ROM structure can be found on MSDN and in Windows CE shared source code. You should look there. I don't remember, but dumprom should output it to console during dumping.
Or you can just guess these addresses