Results 1 to 5 of 5

Thread: Changing the address a dll references

Threaded View

  1. #1

    Changing the address a dll references

    Let's say I have 3 dlls called A, B and C
    C was created long before A and B existed

    A has this address and code 00431415 |. FF15 40BC4300 CALL DWORD PTR DS:[43BC40] ; C.#10043
    but the real location for this in the A.dll is: 00000815 FF15 40BC0010 CALL DWORD PTR DS:[1000BC40]

    C has this address and code at C.#10043
    C.#10043 6FA88E60 A1 54D4A96F MOV EAX,DWORD PTR DS:[6FA9D454]
    but the real location for this in the C.dll is: 00008E60 A1 54D4A96F MOV EAX,DWORD PTR DS:[6FA9D454]

    Now let's say that C's command has moved from 8E60 to 8E65, how can I make A's command refer to it properly?

    I searched through the memory map and looked through A's 'rdata' section which contains 'imports' thinking it has the addresses that link everything but when searching for '43BC40' or '40BC43' or '8E60' or '608E' I find no matches.

    When I actually go to the address 43BC40 in the memory map which is in A's '.data' section I find this: 0043BC3E DA6F 60 FISUBR DWORD PTR DS:[EDI+60]
    where the 43BC40 is the address for '60'

    If I instead go to the address 40BC43 in the memory map which is in B's '.data' section I find this: 0040BC43 0000 ADD BYTE PTR DS:[EAX],AL

    Im confused, what do I need to do to make A properly refer to C?
    Last edited by Steve110; June 19th, 2012 at 08:40. Reason: mistake
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. String references
    By Pompeyfan in forum OllyDbg Support Forums
    Replies: 8
    Last Post: March 3rd, 2004, 04:05
  2. help,Need all the asm references
    By highfly in forum Tools of Our Trade (TOT) Messageboard
    Replies: 3
    Last Post: January 28th, 2004, 22:47
  3. Bad address references in a dumped encrypted dll
    By theraptureback in forum Advanced Reversing and Programming
    Replies: 5
    Last Post: November 23rd, 2003, 21:47
  4. Changing the ID of a window , how to ?
    By Neitsa in forum OllyDbg Support Forums
    Replies: 3
    Last Post: July 29th, 2003, 09:59
  5. Changing EIP
    By homunculus in forum OllyDbg Support Forums
    Replies: 1
    Last Post: February 3rd, 2003, 22:45

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •