Skocz do zawartości
Zakładanie tematu: pomocne raporty i informacje
Nadchodzące zmiany w logowaniu

Far Cry 3 __CxxFrameHandler3 w bibliotece msvcrt.dll

Skwarek

Przez Skwarek
w Windows XP

Rekomendowane odpowiedzi

Skwarek

Skwarek

Opublikowano
Opublikowano

Witam :) Bardzo proszę o pomoc w rozwiązaniu tego problemu ponieważ próbowałem już dużo razy te zrobić lecz ciągle to samo. :( . Pomyślałem że to może się przydać (dumpy , nwm do czego to i co to jest wgl ale z innych postów wyczytałem że może się to przydać) :

http://speedy.sh/KbWTh/dump-athServer.DMP

http://speedy.sh/VGwsW/dump-NMIndexStoreSvr.DMP

http://speedy.sh/dR4Jw/dump-wscntfy.DMP

Odnośnik do komentarza
Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
mgrzeg

mgrzeg

Opublikowano
Opublikowano

Wygląda na to, że program ładuje dynamicznie bibliotekę d3d11.dll, która pochodzi z pakietu DirectX11, niedostępnego na Windows XP. W tablicy importów nie widzę jawnego odniesienia do d3d11, ale jak pisałem - może być ładowana w runtime i bez niej po prostu nie będzie działać.

Spróbuj zmienić nazwę tego pliku z C:\WINDOWS\system32\d3d11.dll na C:\WINDOWS\system32\d3d11.old i uruchomić ponownie program. W przypadku błędu braku pliku ('File not found') -> po zabawie, gra nie zadziała na Windows XP i jedyna opcja to zainstalowanie gry na nowszym systemie (Vista+).

 

 

 

Stos wątków:

 

0:000> ~*e kbn
 # ChildEBP RetAddr  Args to Child             
00 0012f778 7c90df3c 7c8025db 00000254 00000000 ntdll!KiFastSystemCallRet
01 0012f77c 7c8025db 00000254 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
02 0012f7e0 7c802542 00000254 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8
03 0012f7f4 10013cdc 00000254 ffffffff 12420980 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 0012f8ec 100049ad 117d6a80 00c4a3c0 0015234c FC3!RunGame+0xed94
05 0012fee4 10005041 00000000 00000000 00000000 FC3!InitDuniaEngine+0xbed
06 0012ff1c 0040100f 00400000 0015234c 0012ffc0 FC3!RunGame+0xf9
07 0012ff2c 004011b2 00400000 00000000 0015234c farcry3+0x100f
08 0012ffc0 7c817067 00330039 00360037 7ffd7000 farcry3+0x11b2
09 0012fff0 00000000 004012f5 00000000 78746341 kernel32!BaseProcessStart+0x23
 # ChildEBP RetAddr  Args to Child             
00 0102fea8 7c90df3c 7c8025db 00000144 00000000 ntdll!KiFastSystemCallRet
01 0102feac 7c8025db 00000144 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
02 0102ff10 7c802542 00000144 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8
03 0102ff24 1003e80d 00000144 ffffffff 00c83d40 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 00000000 00000000 00000000 00000000 00000000 FC3!RunGame+0x398c5
 # ChildEBP RetAddr  Args to Child             
00 0132e930 7c90d9ac 7c940046 c0000139 00000002 ntdll!KiFastSystemCallRet
01 0132e934 7c940046 c0000139 00000002 00000003 ntdll!ZwRaiseHardError+0xc
02 0132e988 7c91cfbc 77c00000 02c0cbe4 00c0c8e8 ntdll!LdrpSnapThunk+0x36b
03 0132ea0c 7c91d2fb 002525e8 00254570 02c0c2e8 ntdll!LdrpSnapIAT+0x20e
04 0132ea38 7c91d274 7ffd7000 00156638 00000000 ntdll!LdrpHandleOneOldFormatImportDescriptor+0xcc
05 0132ea50 7c91c1ce 7ffd7000 00156638 00254570 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f
06 0132eacc 7c91629d 00156638 00254570 c0150008 ntdll!LdrpWalkImportDescriptor+0x19e
07 0132ed7c 7c9164b3 00000000 00156638 0132f070 ntdll!LdrpLoadDll+0x24e
08 0132f024 7c801bbd 00156638 0132f070 0132f050 ntdll!LdrLoadDll+0x230
09 0132f08c 7c801d72 7ffddc00 00000000 00000000 kernel32!LoadLibraryExW+0x18e
0a 0132f0a0 7c801da8 0156f0ec 00000000 00000000 kernel32!LoadLibraryExA+0x1f
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for systemdetection.dll -
0b 0132f0bc 014d8fc3 0156f0ec 0132f280 12424400 kernel32!LoadLibraryA+0x94
WARNING: Stack unwind information not available. Following frames may be wrong.
0c 0132f1a0 014d8136 0132f624 12424400 00000000 systemdetection!GetScoreInstance+0x36165
0d 0132f280 014cf33e 44d39514 0132f714 12424400 systemdetection!GetScoreInstance+0x352d8
0e 0132f630 014cf05c 44d39404 0132f82c 12424400 systemdetection!GetScoreInstance+0x2c4e0
0f 0132f720 014d4437 44d39b1c 0141dab0 12424400 systemdetection!GetScoreInstance+0x2c1fe
10 0132f838 103d6abc 0141d870 0132f86c 103d76c7 systemdetection!GetScoreInstance+0x315d9
11 0132f844 103d76c7 0141ed20 00000130 00000000 FC3!RunGame+0x3d1b74
12 0132f86c 103f2159 00000000 117d6ab0 32697461 FC3!RunGame+0x3d277f
13 0132fe38 102f2009 00000640 00000384 0141dab0 FC3!RunGame+0x3ed211
14 0132fe5c 102f15a7 00000640 00000384 0141dab0 FC3!RunGame+0x2ed0c1
15 0132fe8c 102cae4d 00000640 00000384 117d6a80 FC3!RunGame+0x2ec65f
16 0132fea0 102cc4ed 00000640 00000384 117d6a80 FC3!RunGame+0x2c5f05
17 0132fed4 102cc673 00000640 00000384 117d6a80 FC3!RunGame+0x2c75a5
18 0132fee8 100bc296 00000640 00000384 117d6a80 FC3!RunGame+0x2c772b
19 0132ff08 1003ad14 0012f888 00c840b0 000001f4 FC3!RunGame+0xb734e
1a 00000000 00000000 00000000 00000000 00000000 FC3!RunGame+0x35dcc
 # ChildEBP RetAddr  Args to Child             
00 0279fe74 7c90df2c 7c809574 00000001 0279fea0 ntdll!KiFastSystemCallRet
01 0279fe78 7c809574 00000001 0279fea0 00000001 ntdll!ZwWaitForMultipleObjects+0xc
02 0279ff14 7e3695f9 00000001 0279ff3c 00000000 kernel32!WaitForMultipleObjectsEx+0x12c
03 0279ff70 6d359a67 00000000 00000000 ffffffff user32!RealMsgWaitForMultipleObjectsEx+0x13e
04 0279ffb4 7c80b713 00188d38 7c912d58 00000000 dinput8!CEm_LL_ThreadProc+0xb6
05 0279ffec 00000000 6d3599b1 00188d38 00000000 kernel32!BaseThreadStart+0x37
 # ChildEBP RetAddr  Args to Child             
00 0289feac 7c90df3c 7c8025db 000001f4 00000000 ntdll!KiFastSystemCallRet
01 0289feb0 7c8025db 000001f4 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
02 0289ff14 7c802542 000001f4 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8
03 0289ff28 10013cdc 000001f4 ffffffff 12470380 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 0289ff5c 1004c58c 12470380 12470384 00000000 FC3!RunGame+0xed94
05 0289ffa8 78afc600 0000000b 0289ffec 7c80b713 FC3!RunGame+0x47644
06 0289ffb4 7c80b713 00c4b190 7c910202 0000000b msvcr100!_endthreadex+0xce
07 0289ffec 00000000 78afc59c 00c4b190 00000000 kernel32!BaseThreadStart+0x37
 # ChildEBP RetAddr  Args to Child             
00 0299fea8 7c90df3c 7c8025db 00000204 00000000 ntdll!KiFastSystemCallRet
01 0299feac 7c8025db 00000204 00000000 0299fee0 ntdll!ZwWaitForSingleObject+0xc
02 0299ff10 7c802542 00000204 00000010 00000000 kernel32!WaitForSingleObjectEx+0xa8
03 0299ff24 10013cff 00000204 00000010 00c8e8a0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 0299ff5c 1004c58c 00c8e8a0 00c8e8a4 00000000 FC3!RunGame+0xedb7
05 0299ffa8 78afc600 00000000 0299ffec 7c80b713 FC3!RunGame+0x47644
06 0299ffb4 7c80b713 00c4b3b0 00000000 00000000 msvcr100!_endthreadex+0xce
07 0299ffec 00000000 78afc59c 00c4b3b0 00000000 kernel32!BaseThreadStart+0x37
 # ChildEBP RetAddr  Args to Child             
00 02a9fe8c 7c90df3c 7c8025db 00000224 00000000 ntdll!KiFastSystemCallRet
01 02a9fe90 7c8025db 00000224 00000000 00000000 ntdll!ZwWaitForSingleObject+0xc
02 02a9fef4 7c802542 00000224 ffffffff 00000000 kernel32!WaitForSingleObjectEx+0xa8
03 02a9ff08 10013cdc 00000224 ffffffff 00c8e9d0 kernel32!WaitForSingleObject+0x12
WARNING: Stack unwind information not available. Following frames may be wrong.
04 02a9ff48 1004c377 00000000 00c8e9d0 00c4b3b0 FC3!RunGame+0xed94
05 02a9ff5c 1004c58c 00c8e9d0 00c8e9d4 00000000 FC3!RunGame+0x4742f
06 02a9ffa8 78afc600 00000000 02a9ffec 7c80b713 FC3!RunGame+0x47644
07 02a9ffb4 7c80b713 00c4b3b0 00000000 00000000 msvcr100!_endthreadex+0xce
08 02a9ffec 00000000 78afc59c 00c4b3b0 00000000 kernel32!BaseThreadStart+0x37

 

Dalej stos dla wątku 2 w którym ładowana jest dynamicznie d3d11

 

0:000> ~2s
eax=00000002 ebx=02c0cbe4 ecx=0019be90 edx=02c0c8d8 esi=c0000139 edi=77c4a428
eip=7c90e4f4 esp=0132e934 ebp=0132e988 iopl=0         nv up ei ng nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000286
ntdll!KiFastSystemCallRet:
7c90e4f4 c3              ret
0:002> kbn
 # ChildEBP RetAddr  Args to Child             
00 0132e930 7c90d9ac 7c940046 c0000139 00000002 ntdll!KiFastSystemCallRet
01 0132e934 7c940046 c0000139 00000002 00000003 ntdll!ZwRaiseHardError+0xc
02 0132e988 7c91cfbc 77c00000 02c0cbe4 00c0c8e8 ntdll!LdrpSnapThunk+0x36b
03 0132ea0c 7c91d2fb 002525e8 00254570 02c0c2e8 ntdll!LdrpSnapIAT+0x20e
04 0132ea38 7c91d274 7ffd7000 00156638 00000000 ntdll!LdrpHandleOneOldFormatImportDescriptor+0xcc
05 0132ea50 7c91c1ce 7ffd7000 00156638 00254570 ntdll!LdrpHandleOldFormatImportDescriptors+0x1f
06 0132eacc 7c91629d 00156638 00254570 c0150008 ntdll!LdrpWalkImportDescriptor+0x19e
07 0132ed7c 7c9164b3 00000000 00156638 0132f070 ntdll!LdrpLoadDll+0x24e
08 0132f024 7c801bbd 00156638 0132f070 0132f050 ntdll!LdrLoadDll+0x230
09 0132f08c 7c801d72 7ffddc00 00000000 00000000 kernel32!LoadLibraryExW+0x18e
0a 0132f0a0 7c801da8 0156f0ec 00000000 00000000 kernel32!LoadLibraryExA+0x1f
0b 0132f0bc 014d8fc3 0156f0ec 0132f280 12424400 kernel32!LoadLibraryA+0x94
WARNING: Stack unwind information not available. Following frames may be wrong.
0c 0132f1a0 014d8136 0132f624 12424400 00000000 systemdetection!GetScoreInstance+0x36165
0d 0132f280 014cf33e 44d39514 0132f714 12424400 systemdetection!GetScoreInstance+0x352d8
0e 0132f630 014cf05c 44d39404 0132f82c 12424400 systemdetection!GetScoreInstance+0x2c4e0
0f 0132f720 014d4437 44d39b1c 0141dab0 12424400 systemdetection!GetScoreInstance+0x2c1fe
10 0132f838 103d6abc 0141d870 0132f86c 103d76c7 systemdetection!GetScoreInstance+0x315d9
11 0132f844 103d76c7 0141ed20 00000130 00000000 FC3!RunGame+0x3d1b74
12 0132f86c 103f2159 00000000 117d6ab0 32697461 FC3!RunGame+0x3d277f
13 0132fe38 102f2009 00000640 00000384 0141dab0 FC3!RunGame+0x3ed211
14 0132fe5c 102f15a7 00000640 00000384 0141dab0 FC3!RunGame+0x2ed0c1
15 0132fe8c 102cae4d 00000640 00000384 117d6a80 FC3!RunGame+0x2ec65f
16 0132fea0 102cc4ed 00000640 00000384 117d6a80 FC3!RunGame+0x2c5f05
17 0132fed4 102cc673 00000640 00000384 117d6a80 FC3!RunGame+0x2c75a5
18 0132fee8 100bc296 00000640 00000384 117d6a80 FC3!RunGame+0x2c772b
19 0132ff08 1003ad14 0012f888 00c840b0 000001f4 FC3!RunGame+0xb734e
1a 00000000 00000000 00000000 00000000 00000000 FC3!RunGame+0x35dcc

 

Dalej potwierdzenie:

 

0:002> da 0156f0ec
0156f0ec  "d3d11"
0:002> du 7ffddc00
7ffddc00  "msvcrt.dll"
 

Lista modułów:

 

0:002> !for_each_module .echo @#FileVersion : @#ModuleName @#ImageName @#LoadedImageName
9.18.944.0000 : XINPUT1_3 C:\WINDOWS\system32\XINPUT1_3.dll
0.0.0.0 : ubiorbitapi_r2_loader C:\Program Files\R.G. Mechanics\Far Cry 3\bin\ubiorbitapi_r2_loader.dll
0.1.0.1 : farcry3 C:\Program Files\R.G. Mechanics\Far Cry 3\bin\farcry3.exe farcry3.exe
9.29.952.3111 : D3DX9_43 C:\WINDOWS\system32\D3DX9_43.dll
0.0.0.0 : uplay_r1_loader C:\Program Files\R.G. Mechanics\Far Cry 3\bin\uplay_r1_loader.dll
1.9.99.0 : binkw32 C:\Program Files\R.G. Mechanics\Far Cry 3\bin\binkw32.dll
1.0.0.8 : systemdetection C:\Program Files\R.G. Mechanics\Far Cry 3\bin\systemdetection.dll systemdetection.dll
6.14.10.1015 : atiadlxx C:\WINDOWS\system32\atiadlxx.dll
6.2.9200.16699 (win8_gdr.130822-1702) : d3d11 C:\WINDOWS\system32\d3d11.dll
0.1.0.1 : FC3 C:\Program Files\R.G. Mechanics\Far Cry 3\bin\FC3.dll FC3.dll
5.1.3102.5512 (xpsp.080413-2105) : GdiPlus C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.5512_x-ww_dfb54e0c\GdiPlus.dll
5.03.2600.5512 (xpsp.080413-0845) : d3d9 C:\WINDOWS\system32\d3d9.dll
5.1.2600.5512 (xpsp.080413-2105) : dbghelp C:\WINDOWS\system32\dbghelp.dll
6.0.2900.5512 : uxtheme C:\WINDOWS\system32\uxtheme.dll
5.1.2600.5512 : glu32 C:\WINDOWS\system32\glu32.dll
5.82 (xpsp.080413-2105) : comctl32_5d520000 C:\WINDOWS\system32\comctl32.dll
5.1.2600.5512 (xpsp.080413-0845) : opengl32 C:\WINDOWS\system32\opengl32.dll
5.1.2600.5512 (xpsp.080413-2108) : hid C:\WINDOWS\system32\hid.dll
5.3.2600.5512 : dinput8 C:\WINDOWS\system32\dinput8.dll dinput8.dll
5.03.2600.5512 (xpsp.080413-0845) : d3d8thk C:\WINDOWS\system32\d3d8thk.dll
5.1.2600.5512 : mswsock C:\WINDOWS\system32\mswsock.dll
5.1.2600.5512 : ws2help C:\WINDOWS\system32\ws2help.dll
5.1.2600.5512 (xpsp.080413-0852) : ws2_32 C:\WINDOWS\system32\ws2_32.dll
5.1.2600.5512 : wsock32 C:\WINDOWS\system32\wsock32.dll
5.3.2600.5512 : ddraw C:\WINDOWS\system32\ddraw.dll
5.1.2600.5512 (xpsp.080413-2105) : dciman32 C:\WINDOWS\system32\dciman32.dll
5.1.2600.5512 : msctf C:\WINDOWS\system32\msctf.dll
5.1.2600.5512 : winmm C:\WINDOWS\system32\winmm.dll
5.1.2600.5512 (xpsp.080413-2105) : psapi C:\WINDOWS\system32\psapi.dll
5.131.2600.5512 : wintrust C:\WINDOWS\system32\wintrust.dll
5.1.2600.5512 (xpsp.080413-2105) : imagehlp C:\WINDOWS\system32\imagehlp.dll
5.1.2600.5512 : iphlpapi C:\WINDOWS\system32\iphlpapi.dll
5.1.2600.5512 (xpsp.080413-2113) : dnsapi C:\WINDOWS\system32\dnsapi.dll
5.1.2600.5512 : wldap32 C:\WINDOWS\system32\wldap32.dll
5.1.2600.5512 (xpsp.080413-2113) : winrnr C:\WINDOWS\system32\winrnr.dll
5.1.2600.5512 (xpsp.080413-0852) : rasadhlp C:\WINDOWS\system32\rasadhlp.dll
5.1.2600.5512 : oleaut32 C:\WINDOWS\system32\oleaut32.dll
6.0.2900.5512 : wininet C:\WINDOWS\system32\wininet.dll
6.0 (xpsp.080413-2105) : comctl32 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
5.1.2600.5512 : ole32 C:\WINDOWS\system32\ole32.dll
5.1.2600.5512 : setupapi C:\WINDOWS\system32\setupapi.dll
5.131.2600.5512 : crypt32 C:\WINDOWS\system32\crypt32.dll
5.1.2600.5512 (xpsp.080413-0852) : msasn1 C:\WINDOWS\system32\msasn1.dll
5.1.2600.5512 (xpsp.080413-2105) : version C:\WINDOWS\system32\version.dll
7.0.2600.5512 (xpsp.080413-2111) : msvcrt C:\WINDOWS\system32\msvcrt.dll
5.1.2600.5512 : advapi32 C:\WINDOWS\system32\advapi32.dll
5.1.2600.5512 (xpsp.080413-2108) : rpcrt4 C:\WINDOWS\system32\rpcrt4.dll
5.1.2600.5512 (xpsp.080413-2105) : gdi32 C:\WINDOWS\system32\gdi32.dll
6.0.2900.5512 : shlwapi C:\WINDOWS\system32\shlwapi.dll
5.1.2600.5512 (xpsp.080413-2113) : secur32 C:\WINDOWS\system32\secur32.dll
10.00.40219.325 : msvcp100 C:\WINDOWS\system32\msvcp100.dll
8.00.50727.6195 : msvcr80 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\msvcr80.dll
10.00.40219.325 : msvcr100 C:\WINDOWS\system32\msvcr100.dll msvcr100.dll
5.1.2600.5512 : kernel32 C:\WINDOWS\system32\kernel32.dll kernel32.dll
5.1.2600.5512 : ntdll C:\WINDOWS\system32\ntdll.dll ntdll.dll
6.0.2900.5512 : shell32 C:\WINDOWS\system32\shell32.dll
5.1.2600.5512 : user32 C:\WINDOWS\system32\user32.dll user32.dll
 

Nagłówek dla farcry.exe:

 

0:002> !dh 00400000

File Type: EXECUTABLE IMAGE
FILE HEADER VALUES
     14C machine (i386)
       5 number of sections
51226A37 time date stamp Mon Feb 18 18:51:51 2013

       0 file pointer to symbol table
       0 number of symbols
      E0 size of optional header
     102 characteristics
            Executable
            32 bit word machine

OPTIONAL HEADER VALUES
     10B magic #
   10.00 linker version
     A00 size of code
   2EC00 size of initialized data
       0 size of uninitialized data
    12F5 address of entry point
    1000 base of code
         ----- new -----
00400000 image base
    1000 section alignment
     200 file alignment
       2 subsystem (Windows GUI)
    5.01 operating system version
    0.00 image version
    5.01 subsystem version
   33000 size of image
     400 size of headers
   3A828 checksum
00100000 size of stack reserve
00001000 size of stack commit
00100000 size of heap reserve
00001000 size of heap commit
    8140  DLL characteristics
            Dynamic base
            NX compatible
            Terminal server aware
       0 [       0] address of Export Directory
    2224 [      50] address of Import Directory
    4000 [   2DDE8] address of Resource Directory
       0 [       0] address of Exception Directory
   2FA00 [    1610] address of Security Directory
   32000 [     144] address of Base Relocation Directory
    20D0 [      1C] address of Debug Directory
       0 [       0] address of Description Directory
       0 [       0] address of Special Directory
       0 [       0] address of Thread Storage Directory
    2128 [      40] address of Load Configuration Directory
       0 [       0] address of Bound Import Directory
    2000 [      B4] address of Import Address Table Directory
       0 [       0] address of Delay Import Directory
       0 [       0] address of COR20 Header Directory
       0 [       0] address of Reserved Directory

SECTION HEADER #1
   .text name
     84A virtual size
    1000 virtual address
     A00 size of raw data
     400 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         (no align specified)
         Execute Read

SECTION HEADER #2
  .rdata name
     636 virtual size
    2000 virtual address
     800 size of raw data
     E00 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         (no align specified)
         Read Only

Debug Directories(1)
 Type       Size     Address  Pointer
 cv           3b        2170      f70 Format: RSDS, guid, 85, R:\FC3-SUB-PC-44.0\bin\farcry3.pdb

SECTION HEADER #3
   .data name
     38C virtual size
    3000 virtual address
     200 size of raw data
    1600 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
C0000040 flags
         Initialized Data
         (no align specified)
         Read Write

SECTION HEADER #4
   .rsrc name
   2DDE8 virtual size
    4000 virtual address
   2DE00 size of raw data
    1800 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         (no align specified)
         Read Only

SECTION HEADER #5
  .reloc name
     360 virtual size
   32000 virtual address
     400 size of raw data
   2F600 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
42000040 flags
         Initialized Data
         Discardable
         (no align specified)
         Read Only

 

I tablica importów:

 

0:002> dps 00400000+2000 LB4/8
00402000  10004f48 FC3!RunGame
00402004  00000000
00402008  7c813123 kernel32!IsDebuggerPresent
0040200c  7c863e6a kernel32!UnhandledExceptionFilter
00402010  7c80de85 kernel32!GetCurrentProcess
00402014  7c801e1a kernel32!TerminateProcess
00402018  7c8017e9 kernel32!GetSystemTimeAsFileTime
0040201c  7c8099b0 kernel32!GetCurrentProcessId
00402020  7c8097b8 kernel32!GetCurrentThreadId
00402024  7c80932e kernel32!GetTickCount
00402028  7c80a4b7 kernel32!QueryPerformanceCounter
0040202c  7c913405 ntdll!RtlDecodePointer
00402030  7c8449fd kernel32!SetUnhandledExceptionFilter
00402034  7c9133df ntdll!RtlEncodePointer
00402038  7c801e54 kernel32!GetStartupInfoW
0040203c  7c839481 kernel32!HeapSetInformation
00402040  7c809832 kernel32!InterlockedCompareExchange
00402044  7c802446 kernel32!Sleep
00402048  7c80981e kernel32!InterlockedExchange
0040204c  00000000
00402050  78ab0910 msvcr100!_lock
00402054  78aba9e6 msvcr100!_onexit

 

m.g.

Odnośnik do komentarza
Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...