Bueno, por lo visto al Olly no le gustan las Export Tables que no exportan 
Aqui hay un code para parchear un fichero
Lo he traducido de un codigo en Delphi, para mas Info mirar en los comentarios
Lo he provado con el OllyDbg v1 y da errores.. pero con el OllyDbg BETA lo carga sin problemas
Saludos
Aqui hay un code para parchear un fichero
Lo he traducido de un codigo en Delphi, para mas Info mirar en los comentarios
Lo he provado con el OllyDbg v1 y da errores.. pero con el OllyDbg BETA lo carga sin problemas
Código (vb) [Seleccionar]
'---------------------------------------------------------------------------------------
' Module : mNoOlly
' Author : Karcrack
' DateTime : 18/01/2009 00:41
' Purpose : AntiOlly
' Reference : http://hackhound.org/forum/index.php?topic=8387.0;topicseen
'
' Thanks : Cobein, for his ChangeOEP code :D
'---------------------------------------------------------------------------------------
Option Explicit
Private Const IMAGE_DOS_SIGNATURE As Long = &H5A4D&
Private Const IMAGE_NT_SIGNATURE As Long = &H4550&
Private Const SIZE_DOS_HEADER As Long = &H40
Private Const SIZE_NT_HEADERS As Long = &HF8
Private Const SIZE_SECTION_HEADER As Long = &H28
Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type
Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type
Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type
Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type
Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type
Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Dest As Any, Src As Any, ByVal L As Long)
Public Function PatchFile(ByRef bFile() As Byte) As Byte()
Dim IDH As IMAGE_DOS_HEADER
Dim INH As IMAGE_NT_HEADERS
Call CopyMemory(IDH, bFile(0), SIZE_DOS_HEADER)
If IDH.e_magic = IMAGE_DOS_SIGNATURE Then
Call CopyMemory(INH, bFile(IDH.e_lfanew), SIZE_NT_HEADERS)
If INH.Signature = IMAGE_NT_SIGNATURE Then
INH.OptionalHeader.DataDirectory(0).VirtualAddress = &H1000
INH.OptionalHeader.DataDirectory(0).Size = &HF000
Call CopyMemory(bFile(IDH.e_lfanew), INH, SIZE_NT_HEADERS)
PatchFile = bFile
End If
End If
End FunctionSaludos
![:-\](https://forum.elhacker.net/Smileys/navidad/undecided.gif ":-\")
