[HELP] File is not a portable executable. DOS header does not contain 'MZ' signature

[evildog1]

Hi

When i open Assembly-CSharp.dll File on .NET Reflector, i got the error that say "Assembly-CSharp, File is not a portable executable. DOS header does not contain 'MZ' signature.". can someone help me with this and how to dump the game? it is possible to decrypt DLL file and make it execute-able but peoples won't help me, always give me bad explaination and ignore me.

The game is named Call Of Duty Heroes Android. I had modded it before and i always modify units damage so units can destroy the buildings instantly but now the game is encrypted for good and it is dead end for me.

I found the steps how to dump the game but i have no idea how to cut out DLL file with the big 900 MB file. i don't know what to do...

 Spoiler

1. Download gcore
2. extract.
3. Copy all file in folder bin to /system/bin in my device and grant root access.
4. Download Terminal app from play Store and run it
5. Run the encrypted game (Darkness Rebord or Crusaders quest)
6. type

su
dumpsys meminfo | grep com.gamevil.*

i will get pid
7. type

gdb -pid xxxx
gcore /sdcard/a

8. So i will get file named "a" about 800-900 mb in sdcard and copy it to my computer

I found an article about dumping an Android game and decrypt classes.dex file so the codes can be human readable but i have no idea what program to use.



Link to encrypted DLL files:

[alpines]

A DLL file is not supposed to be executed (except for Code-Injection like Creating Threads and Hooking Functions). It provides functions which are called by the program which loads the DLL. It doesn't contain the MZ signature because it is no executable.

So it's not possible to execute the file itself but its functions. If you want to find out the functions you may use analysis programs which tell you the functions the DLL contains.

[Jeoni]

Originally Posted by alpines

It doesn't contain the MZ signature because it is no executable.

May I correct you on this one? A valid Windows DLL file does contain the 'MZ' signature just like an executable (.exe) file. Both belong to the group of portable executable (PE) files and start with a DOS header at file offset 0. And at the start of this structure there is the e_magic member which supposed to be the 'MZ'. As far as I know if you change that signature to something else, windows will deny loading the DLL when it's needed just like it denies to start the executable if the 'MZ' is missing on that one.
And in fact there are just minor differences between a DLL and an executable. As far as I know it's just some flag in the PE headers and the signature of the entry point function which is referenced in the PE headers. Furthermore an entry point is optional for DLL files thus the corresponding field in the headers could be 0. I don't think that there are more differences.

With best regards
Jeoni

[alpines]

Originally Posted by Jeoni

...

Thanks for the correction. The more you know...