How do I use icedump?

[zampt]

First of all, thanks for trying to help me!

I have only used procdump, so I could need som hints on how to use icedump.
What should I do after using softice to patch
f-sec.

*How do I dump?

*How do I fix pe-header and import table?

zampt

[CoDe_InSiDe]

Hi zampt,

Well i assume you installed Icedump right?
Then read the Manual and all become clear

Cya...

CoDe_InSiDe

[tsehp]

yes, in the manual you'll see a lot of commands, the most usefull to me are :
/pedump (automated dump, fixing the pe)
/trace or /tracex to find the program's oep
/protection to look for certain protection schemes that dwelve with interrupts or seh through the idt.

[Cast]

is it just me or does Icedump for windows NT not support these features ? - all i can use with icedump for NT is pagein..

Maybe i dident config it right - i donno

[zampt]

Hi !

Thanks for all the help, I will try to use Icedump.
One other thing, if I use TRW then I will need to
fix the pe of the dump, am I right?

Once again..thanks!

zampt

[CoDe_InSiDe]

Hi zampt,

Yes you need to change the OEP and maybe some other stuff in the Sections

Cya...

CoDe_InSiDe