protect.dll

[bassbanane]

hey nur ne frage ich hab mal die protect.dll vom xiu p-server mit tdump von delhi geöffet und das is dabei rausgekommen

.


Old Executable Header

DOS File Size 10F800h (1112064. )
Load Image Size 210h ( 528. )
Relocation Table entry count 0000h ( 0. )
Relocation Table address 0040h ( 64. )
Size of header record (in paragraphs) 0004h ( 4. )
Minimum Memory Requirement (in paragraphs) 000Fh ( 15. )
Maximum Memory Requirement (in paragraphs) FFFFh ( 65535. )
File load checksum 0000h ( 0. )
Overlay Number 001Ah ( 26. )

Initial Stack Segment (SS:SP) 0000:00B8
Program Entry Point (CS:IP) 0000:0000


Portable Executable (PE) File

Header base: 00000200

CPU type 80386
Flags 230E [ executable backwards 32bit library ]
DLL flags 0000 [ ]
Linker Version 5.0
Time stamp 47CA076E
O/S Version 4.0
User Version 0.0
Subsystem Version 4.0
Subsystem 0003 [ Windows character ]
Object count 00000008
Symbols offset 00000000
Symbols count 00000000
Optional header size 00E0
Magic # 10B
Code size 00122000
Init Data size 00043000
Uninit Data size 00000000
Entry RVA 001D28DD
Image base 00400000
Code base 00001000
Data base 00123000
Object/File align 00001000/00000200
Reserved 00000000
Image size 001DB000
Header size 00000600
Checksum 00000000
Stack reserve/commit 00000000/00000000
Heap reserve/commit 00100000/00001000
Number interesting RVAs 00000010
Name RVA Size
------------------ -------- --------
Exports 0016A000 000004F7
Imports 001D2000 00000260
Resources 0016B000 0005A000
Exceptions 00000000 00000000
Security 00000000 00000000
Fixups 001D539D 00000008
Debug 00000000 00000000
Description 00000000 00000000
TLS 00000000 00000000
Callbacks 00000000 00000000
reserved 00000000 00000000
reserved 00000000 00000000
reserved 00000000 00000000
reserved 00000000 00000000
reserved 00000000 00000000

Object table:
# Name VirtSize RVA PhysSize Phys off Flags
-- -------- -------- -------- -------- -------- --------
01 00122000 00001000 00087C00 00000600 C0000040 [IRW]
02 00043000 00123000 0001C200 00088200 C0000040 [IRW]
03 00001000 00166000 00000200 000A4400 C0000040 [IRW]
04 00003000 00167000 00001200 000A4600 C0000040 [IRW]
05 00001000 0016A000 00000600 000A5800 C0000040 [IRW]
06 .rsrc 0005A000 0016B000 0005A000 000A5E00 C0000040 [IRW]
07 .reloc 0000D000 001C5000 0000C600 000FFE00 C0000040 [IRW]
08 3.01 UPX 00009000 001D2000 00003400 0010C400 C0000040 [IRW]

Key to section flags:
I - contains initialized data
R - readable
W - writeable

Imports from Kernel32.dll
LoadLibraryA
GetProcAddress
GetModuleHandleA

Imports from User32.dll
GetKeyboardType
WindowFromPoint

Imports from AdvApi32.dll
RegQueryValueExA
RegSetValueExA
StartServiceA

Imports from Oleaut32.dll
SysFreeString
CreateErrorInfo
SafeArrayPtrOfIndex

Imports from Gdi32.dll
UnrealizeObject

Imports from Ole32.dll
CreateStreamOnHGlobal
IsEqualGUID

Imports from ComCtl32.dll
ImageList_SetIconSize

Exports from Protect_.dll
41 exported name(s), 41 export addresse(s). Ordinal base is 1.
Ordinal RVA Name
------- -------- ----
0001 000028d0 ::Blowfish::Finalize
0000 000028c0 ::Blowfish::Initialize
0032 00083738 ::Commandhandler::Finalize
0031 00083728 ::Commandhandler::Initialize
0003 00010fb0 ::Config::Finalize
0002 00010f98 ::Config::Initialize
0036 000854e4 :ebug::Finalize
0035 000854cc :ebug::Initialize
0005 00012d40 ::Engine::Finalize
0004 00012d30 ::Engine::Initialize
0007 00012ec4 ::Hook::Finalize
0006 00012eb4 ::Hook::Initialize
0038 000856a0 ::Hookinstance::Finalize
0037 00085690 ::Hookinstance::Initialize
0009 00013d1c ::Md5::Finalize
0008 00013d0c ::Md5::Initialize
0034 00084f44 ::Md5instance::Finalize
0033 00084f34 ::Md5instance::Initialize
0030 00048a0c ::Mhook::Finalize
0029 000489f4 ::Mhook::Initialize
0011 000157c0 ::Properties::Finalize
0010 000157b0 ::Properties::Initialize
0013 0001b7c8 ::Protectcheckthread::Finalize
0012 0001b7b0 ::Protectcheckthread::Initialize
0015 00020fb4 ::Scriptengine::Finalize
0014 00020fa4 ::Scriptengine::Initialize
0028 000484bc ::Showmessage::Finalize
0027 000484ac ::Showmessage::Initialize
0017 00021aa8 ::Splash::Finalize
0016 00021a98 ::Splash::Initialize
0019 0002295c ::Tools::Finalize
0018 0002294c ::Tools::Initialize
0021 000409e8 GetUserNameA
0026 00040a24 RegCloseKey
0024 00040a0c RegCreateKeyExA
0022 000409f4 RegOpenKeyA
0025 00040a18 RegQueryValueExA
0023 00040a00 RegSetValueExA
0040 0015e300 _Form3
0020 00040960 _ShowSplash
0039 001230f8 ___CPPdebugHook

Resources:
Type Name Lang Id
--------------------------------------------
[0 named entries, 7 ID entries]
1 (next directory @00000048)

[0 named entries, 7 ID entries]
1 (next directory @000001B8)

[0 named entries, 1 ID entries]
1033 (data @000004B8)
Offset: 0016B6E8
Size: 00000134
Code Page: 00000000
Reserved: 00000000

2 (next directory @000001D0)

[0 named entries, 1 ID entries]
1033 (data @000004C8)
Offset: 0016B81C
Size: 00000134
Code Page: 00000000
Reserved: 00000000

3 (next directory @000001E8)

[0 named entries, 1 ID entries]
1033 (data @000004D8)
Offset: 0016B950
Size: 00000134
Code Page: 00000000
Reserved: 00000000

4 (next directory @00000200)

[0 named entries, 1 ID entries]
1033 (data @000004E8)
Offset: 0016BA84
Size: 00000134
Code Page: 00000000
Reserved: 00000000

5 (next directory @00000218)

[0 named entries, 1 ID entries]
1033 (data @000004F8)
Offset: 0016BBB8
Size: 00000134
Code Page: 00000000
Reserved: 00000000

6 (next directory @00000230)

[0 named entries, 1 ID entries]
1033 (data @00000508)
Offset: 0016BCEC
Size: 00000134
Code Page: 00000000
Reserved: 00000000

7 (next directory @00000248)

[0 named entries, 1 ID entries]
1033 (data @00000518)
Offset: 0016BE20
Size: 00000134
Code Page: 00000000
Reserved: 00000000

3 (next directory @00000090)

[0 named entries, 1 ID entries]
1 (next directory @00000260)

[0 named entries, 1 ID entries]
1031 (data @00000528)
Offset: 0016BF54
Size: 000010A8
Code Page: 00000000
Reserved: 00000000

6 (next directory @000000A8)

[0 named entries, 13 ID entries]
4084 (next directory @00000278)

[0 named entries, 1 ID entries]
0 (data @00000538)
Offset: 0016CFFC
Size: 0000032C
Code Page: 00000000
Reserved: 00000000

4085 (next directory @00000290)

[0 named entries, 1 ID entries]
0 (data @00000548)
Offset: 0016D328
Size: 000000C8
Code Page: 00000000
Reserved: 00000000

4086 (next directory @000002A8)

[0 named entries, 1 ID entries]
0 (data @00000558)
Offset: 0016D3F0
Size: 00000100
Code Page: 00000000
Reserved: 00000000

4087 (next directory @000002C0)

[0 named entries, 1 ID entries]
0 (data @00000568)
Offset: 0016D4F0
Size: 00000430
Code Page: 00000000
Reserved: 00000000

4088 (next directory @000002D8)

[0 named entries, 1 ID entries]
0 (data @00000578)
Offset: 0016D920
Size: 0000037C
Code Page: 00000000
Reserved: 00000000

4089 (next directory @000002F0)

[0 named entries, 1 ID entries]
0 (data @00000588)
Offset: 0016DC9C
Size: 000000EC
Code Page: 00000000
Reserved: 00000000

4090 (next directory @00000308)

[0 named entries, 1 ID entries]
0 (data @00000598)
Offset: 0016DD88
Size: 000000D0
Code Page: 00000000
Reserved: 00000000

4091 (next directory @00000320)

[0 named entries, 1 ID entries]
0 (data @000005A8)
Offset: 0016DE58
Size: 0000029C
Code Page: 00000000
Reserved: 00000000

4092 (next directory @00000338)

[0 named entries, 1 ID entries]
0 (data @000005B8)
Offset: 0016E0F4
Size: 0000040C
Code Page: 00000000
Reserved: 00000000

4093 (next directory @00000350)

[0 named entries, 1 ID entries]
0 (data @000005C8)
Offset: 0016E500
Size: 00000330
Code Page: 00000000
Reserved: 00000000

4094 (next directory @00000368)

[0 named entries, 1 ID entries]
0 (data @000005D8)
Offset: 0016E830
Size: 000002E8
Code Page: 00000000
Reserved: 00000000

4095 (next directory @00000380)

[0 named entries, 1 ID entries]
0 (data @000005E8)
Offset: 0016EB18
Size: 00000384
Code Page: 00000000
Reserved: 00000000

4096 (next directory @00000398)

[0 named entries, 1 ID entries]
0 (data @000005F8)
Offset: 0016EE9C
Size: 00000454
Code Page: 00000000
Reserved: 00000000

10 (next directory @00000120)

[2 named entries, 0 ID entries]
DVCLAL (next directory @000003B0)

[0 named entries, 1 ID entries]
0 (data @00000608)
Offset: 0016F2F0
Size: 00000010
Code Page: 00000000
Reserved: 00000000

TFORM3 (next directory @000003C8)

[0 named entries, 1 ID entries]
0 (data @00000618)
Offset: 0016F300
Size: 00055818
Code Page: 00000000
Reserved: 00000000

12 (next directory @00000140)

[0 named entries, 7 ID entries]
32761 (next directory @000003E0)

[0 named entries, 1 ID entries]
1033 (data @00000628)
Offset: 001C4B18
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32762 (next directory @000003F8)

[0 named entries, 1 ID entries]
1033 (data @00000638)
Offset: 001C4B2C
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32763 (next directory @00000410)

[0 named entries, 1 ID entries]
1033 (data @00000648)
Offset: 001C4B40
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32764 (next directory @00000428)

[0 named entries, 1 ID entries]
1033 (data @00000658)
Offset: 001C4B54
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32765 (next directory @00000440)

[0 named entries, 1 ID entries]
1033 (data @00000668)
Offset: 001C4B68
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32766 (next directory @00000458)

[0 named entries, 1 ID entries]
1033 (data @00000678)
Offset: 001C4B7C
Size: 00000014
Code Page: 00000000
Reserved: 00000000

32767 (next directory @00000470)

[0 named entries, 1 ID entries]
1033 (data @00000688)
Offset: 001C4B90
Size: 00000014
Code Page: 00000000
Reserved: 00000000

14 (next directory @00000188)

[1 named entries, 0 ID entries]
MAINICON (next directory @00000488)

[0 named entries, 1 ID entries]
1031 (data @00000698)
Offset: 001C4BA4
Size: 00000014
Code Page: 00000000
Reserved: 00000000

16 (next directory @000001A0)

[0 named entries, 1 ID entries]
1 (next directory @000004A0)

[0 named entries, 1 ID entries]
1031 (data @000006A8)
Offset: 001C4BB8
Size: 00000318
Code Page: 00000000
Reserved: 00000000




C:WINDOWSsystem32>

und könnte ma die dll nich so umschreiben sodass kal nich imma schließt wenn er ne hackengine oda ähnliches findet? answer fast pls



ich hab auch nochma die engine.exe mit tdump geöffnet falls es euch hilft aba ich werd nich schlau daraus^^

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.



Old Executable Header

DOS File Size 1FC000h (2080768. )
Load Image Size 450h ( 1104. )
Relocation Table entry count 0000h ( 0. )
Relocation Table address 0040h ( 64. )
Size of header record (in paragraphs) 0004h ( 4. )
Minimum Memory Requirement (in paragraphs) 0000h ( 0. )
Maximum Memory Requirement (in paragraphs) FFFFh ( 65535. )
File load checksum 0000h ( 0. )
Overlay Number 0000h ( 0. )

Initial Stack Segment (SS:SP) 0000:00B8
Program Entry Point (CS:IP) 0000:0000


Portable Executable (PE) File

Header base: 00000138

CPU type 80386
Flags 10F [ fixed executable backwards 32bit ]
DLL flags 0000 [ ]
Linker Version 53.52
Time stamp 44725D18
O/S Version 4.0
User Version 0.0
Subsystem Version 4.0
Subsystem 0002 [ Windows GUI ]
Object count 00000006
Symbols offset 00000000
Symbols count 00000000
Optional header size 00E0
Magic # 10B
Code size 00052000
Init Data size 001A9000
Uninit Data size 00000000
Entry RVA 00449000
Image base 00400000
Code base 003F9000
Data base 00459000
Object/File align 00001000/00001000
Reserved 00000000
Image size 0061C000
Header size 00001000
Checksum 00205380
Stack reserve/commit 00200000/00001000
Heap reserve/commit 00100000/00001000
Number interesting RVAs 00000010
Name RVA Size
------------------ -------- --------
Exports 00000000 00000000
Imports 004622A8 00000050
Resources 00619000 00000658
Exceptions 00000000 00000000
Security 00000000 00000000
Fixups 00000000 00000000
Debug 00000000 00000000
Description 00000000 00000000
TLS 00000000 00000000
Callbacks 00000000 00000000
reserved 00000000 00000000
reserved 00459000 000002BC
reserved 002D93A8 00000040
reserved 00000000 00000000
reserved 00000000 00000000

Object table:
# Name VirtSize RVA PhysSize Phys off Flags
-- -------- -------- -------- -------- -------- --------
01 .text 003F8000 00001000 00000000 00000000 E0000060 [CIERW]
02 .text1 00050000 003F9000 00042000 00001000 E0000020 [CERW]
03 .adata 00010000 00449000 0000D000 00043000 E0000020 [CERW]
04 .data 00020000 00459000 0000B000 00050000 C0000040 [IRW]
05 .pdata 001A0000 00479000 0019E000 0005B000 C0000040 [IRW]
06 .rsrc 00003000 00619000 00003000 001F9000 E0000060 [CIERW]

Key to section flags:
C - contains code
E - executable
I - contains initialized data
R - readable
W - writeable

Imports from KERNEL32.dll
CreateThread(hint = 006f)
GlobalUnlock(hint = 020a)
GlobalLock(hint = 0203)
GlobalAlloc(hint = 01f8)
GetTickCount(hint = 01df)
WideCharToMultiByte(hint = 0394)
IsBadReadPtr(hint = 0233)
GlobalAddAtomA(hint = 01f6)
GlobalAddAtomW(hint = 01f7)
GetModuleHandleA(hint = 017f)
GlobalFree(hint = 01ff)
GlobalGetAtomNameA(hint = 0200)
GlobalDeleteAtom(hint = 01fa)
GlobalGetAtomNameW(hint = 0201)
FreeConsole(hint = 00f5)
GetEnvironmentVariableA(hint = 0158)
VirtualProtect(hint = 0386)
VirtualAlloc(hint = 0381)
GetProcAddress(hint = 01a0)
GetLastError(hint = 0171)
LoadLibraryA(hint = 0252)
SetLastError(hint = 0328)
SetThreadPriority(hint = 0344)
GetCurrentThread(hint = 0145)
CreateProcessA(hint = 0066)
GetCommandLineA(hint = 0110)
GetStartupInfoA(hint = 01b7)
SetEnvironmentVariableA(hint = 0313)
ReleaseMutex(hint = 02c2)
WaitForSingleObject(hint = 0390)
CreateMutexA(hint = 0060)
OpenMutexA(hint = 0284)
GetCurrentThreadId(hint = 0146)
CreateFileA(hint = 0053)
FindClose(hint = 00ce)
FindFirstFileA(hint = 00d2)
FindFirstFileW(hint = 00d5)
VirtualQueryEx(hint = 0389)
GetExitCodeProcess(hint = 015a)
ReadProcessMemory(hint = 02b8)
UnmapViewOfFile(hint = 0371)
ContinueDebugEvent(hint = 003e)
SetThreadContext(hint = 0340)
GetThreadContext(hint = 01d7)
WaitForDebugEvent(hint = 038d)
SuspendThread(hint = 0358)
DebugActiveProcess(hint = 0076)
ResumeThread(hint = 02d2)
CreateProcessW(hint = 0069)
GetCommandLineW(hint = 0111)
GetStartupInfoW(hint = 01b8)
CloseHandle(hint = 0034)
DuplicateHandle(hint = 0093)
GetCurrentProcess(hint = 0142)
CreateFileMappingA(hint = 0054)
VirtualProtectEx(hint = 0387)
WriteProcessMemory(hint = 03ad)
ExitProcess(hint = 00b9)
FlushFileBuffers(hint = 00ee)
WriteConsoleW(hint = 03a3)
GetConsoleOutputCP(hint = 0135)
WriteConsoleA(hint = 0399)
SetStdHandle(hint = 0337)
GetStringTypeW(hint = 01bd)
GetStringTypeA(hint = 01ba)
LCMapStringW(hint = 0245)
LCMapStringA(hint = 0244)
GetConsoleMode(hint = 0133)
GetConsoleCP(hint = 0122)
SetFilePointer(hint = 031b)
GetLocaleInfoA(hint = 0174)
MultiByteToWideChar(hint = 0275)
HeapSize(hint = 021c)
HeapReAlloc(hint = 021a)
QueryPerformanceCounter(hint = 02a3)
VirtualFree(hint = 0383)
HeapCreate(hint = 0212)
HeapDestroy(hint = 0214)
GetFileType(hint = 0166)
SetHandleCount(hint = 0324)
GetEnvironmentStringsW(hint = 0157)
FreeEnvironmentStringsW(hint = 00f7)
GetEnvironmentStrings(hint = 0155)
FreeEnvironmentStringsA(hint = 00f6)
IsValidCodePage(hint = 023f)
GetOEMCP(hint = 0193)
GetACP(hint = 00fd)
GetCPInfo(hint = 0104)
RtlUnwind(hint = 02d7)
DeleteCriticalSection(hint = 0081)
GetStdHandle(hint = 01b9)
WriteFile(hint = 03a4)
Sleep(hint = 0356)
EnterCriticalSection(hint = 0098)
LeaveCriticalSection(hint = 0251)
GetVersionExA(hint = 01e9)
InitializeCriticalSection(hint = 0223)
GetCurrentProcessId(hint = 0143)
GetModuleFileNameW(hint = 017e)
GetShortPathNameW(hint = 01b6)
GetModuleFileNameA(hint = 017d)
MapViewOfFile(hint = 0268)
GetShortPathNameA(hint = 01b5)
GetSystemTimeAsFileTime(hint = 01ca)
HeapFree(hint = 0216)
HeapAlloc(hint = 0210)
GetProcessHeap(hint = 01a3)
RaiseException(hint = 02a7)
TerminateProcess(hint = 035e)
UnhandledExceptionFilter(hint = 036e)
SetUnhandledExceptionFilter(hint = 034a)
IsDebuggerPresent(hint = 0239)
TlsGetValue(hint = 0365)
TlsAlloc(hint = 0363)
TlsSetValue(hint = 0366)
TlsFree(hint = 0364)
InterlockedIncrement(hint = 022c)
InterlockedDecrement(hint = 0228)

Imports from USER32.dll
GetDesktopWindow(hint = 010e)
MoveWindow(hint = 01ec)
SetPropA(hint = 026a)
EnumThreadWindows(hint = 00db)
GetPropA(hint = 014a)
GetMessageA(hint = 013a)
GetSystemMetrics(hint = 015d)
SetTimer(hint = 027a)
GetAsyncKeyState(hint = 00f2)
KillTimer(hint = 01b5)
BeginPaint(hint = 000d)
EndPaint(hint = 00c8)
SetWindowTextA(hint = 0286)
GetDlgItem(hint = 0111)
CreateDialogIndirectParamA(hint = 0052)
ShowWindow(hint = 0292)
UpdateWindow(hint = 02bc)
LoadStringA(hint = 01cb)
LoadStringW(hint = 01cc)
FindWindowA(hint = 00e3)
WaitForInputIdle(hint = 02ce)
MessageBoxA(hint = 01df)
InSendMessage(hint = 0188)
UnpackDDElParam(hint = 02b2)
FreeDDElParam(hint = 00ea)
DefWindowProcA(hint = 008e)
LoadCursorA(hint = 01ba)
RegisterClassW(hint = 0219)
CreateWindowExW(hint = 0061)
RegisterClassA(hint = 0216)
CreateWindowExA(hint = 0060)
GetWindowThreadProcessId(hint = 017b)
SendMessageW(hint = 0240)
SendMessageA(hint = 023b)
PeekMessageA(hint = 0200)
TranslateMessage(hint = 02aa)
DispatchMessageA(hint = 00a1)
EnumWindows(hint = 00de)
IsWindowUnicode(hint = 01b0)
PackDDElParam(hint = 01fd)
PostMessageW(hint = 0203)
PostMessageA(hint = 0202)
IsWindow(hint = 01ad)
DestroyWindow(hint = 0099)

Imports from GDI32.dll
CreateDCA(hint = 002e)
CreateDIBitmap(hint = 0033)
CreateCompatibleDC(hint = 002d)
SelectObject(hint = 020e)
SelectPalette(hint = 020f)
RealizePalette(hint = 01f3)
BitBlt(hint = 0012)
DeleteDC(hint = 008c)
DeleteObject(hint = 008f)
CreatePalette(hint = 0045)

Resources:
Type Name Lang Id
--------------------------------------------
[0 named entries, 4 ID entries]
1 (next directory @00000030)

[0 named entries, 8 ID entries]
1 (next directory @00000080)

[0 named entries, 1 ID entries]
1033 (data @00000098)
Offset: 00608000
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

2 (next directory @000000A8)

[0 named entries, 1 ID entries]
1033 (data @000000C0)
Offset: 00609630
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

3 (next directory @000000D0)

[0 named entries, 1 ID entries]
1033 (data @000000E8)
Offset: 0060AC60
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

4 (next directory @000000F8)

[0 named entries, 1 ID entries]
1033 (data @00000110)
Offset: 0060C290
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

5 (next directory @00000120)

[0 named entries, 1 ID entries]
1033 (data @00000138)
Offset: 0060D8C0
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

6 (next directory @00000148)

[0 named entries, 1 ID entries]
1033 (data @00000160)
Offset: 0060EEF0
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

7 (next directory @00000170)

[0 named entries, 1 ID entries]
1033 (data @00000188)
Offset: 00610520
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

8 (next directory @00000198)

[0 named entries, 1 ID entries]
1033 (data @000001B0)
Offset: 00611B50
Size: 0000162C
Code Page: 00000000
Reserved: 00000000

5 (next directory @000001C0)

[0 named entries, 14 ID entries]
144 (next directory @00000240)

[0 named entries, 1 ID entries]
1033 (data @00000258)
Offset: 00613180
Size: 00000648
Code Page: 00000000
Reserved: 00000000

161 (next directory @00000268)

[0 named entries, 1 ID entries]
1042 (data @00000280)
Offset: 006137C8
Size: 000006B0
Code Page: 00000000
Reserved: 00000000

162 (next directory @00000290)

[0 named entries, 1 ID entries]
1033 (data @000002A8)
Offset: 00613E78
Size: 0000037C
Code Page: 00000000
Reserved: 00000000

171 (next directory @000002B8)

[0 named entries, 1 ID entries]
1042 (data @000002D0)
Offset: 006141F8
Size: 00001CB2
Code Page: 00000000
Reserved: 00000000

180 (next directory @000002E0)

[0 named entries, 1 ID entries]
1042 (data @000002F8)
Offset: 00615EB0
Size: 0000018C
Code Page: 00000000
Reserved: 00000000

182 (next directory @00000308)

[0 named entries, 1 ID entries]
1042 (data @00000320)
Offset: 00616040
Size: 00000616
Code Page: 00000000
Reserved: 00000000

188 (next directory @00000330)

[0 named entries, 1 ID entries]
1042 (data @00000348)
Offset: 00616658
Size: 0000012C
Code Page: 00000000
Reserved: 00000000

190 (next directory @00000358)

[0 named entries, 1 ID entries]
1042 (data @00000370)
Offset: 00616788
Size: 000007F6
Code Page: 00000000
Reserved: 00000000

192 (next directory @00000380)

[0 named entries, 1 ID entries]
1042 (data @00000398)
Offset: 00616F80
Size: 00000164
Code Page: 00000000
Reserved: 00000000

196 (next directory @000003A8)

[0 named entries, 1 ID entries]
1042 (data @000003C0)
Offset: 006170E8
Size: 00000142
Code Page: 00000000
Reserved: 00000000

197 (next directory @000003D0)

[0 named entries, 1 ID entries]
1042 (data @000003E8)
Offset: 00617230
Size: 00000124
Code Page: 00000000
Reserved: 00000000

198 (next directory @000003F8)

[0 named entries, 1 ID entries]
1042 (data @00000410)
Offset: 00617358
Size: 000004E0
Code Page: 00000000
Reserved: 00000000

209 (next directory @00000420)

[0 named entries, 1 ID entries]
1042 (data @00000438)
Offset: 00617838
Size: 00000498
Code Page: 00000000
Reserved: 00000000

210 (next directory @00000448)

[0 named entries, 1 ID entries]
1042 (data @00000460)
Offset: 00617CD0
Size: 0000014A
Code Page: 00000000
Reserved: 00000000

6 (next directory @00000470)

[0 named entries, 1 ID entries]
11 (next directory @00000488)

[0 named entries, 2 ID entries]
1033 (data @000004A8)
Offset: 00617E20
Size: 00000022
Code Page: 00000000
Reserved: 00000000

1042 (data @000004B8)
Offset: 00617E48
Size: 00000022
Code Page: 00000000
Reserved: 00000000

12 (next directory @000004C8)

[0 named entries, 8 ID entries]
200 (next directory @00000518)

[0 named entries, 1 ID entries]
1033 (data @00000530)
Offset: 00617E70
Size: 00000014
Code Page: 00000000
Reserved: 00000000

201 (next directory @00000540)

[0 named entries, 1 ID entries]
1033 (data @00000558)
Offset: 00617E88
Size: 00000014
Code Page: 00000000
Reserved: 00000000

202 (next directory @00000568)

[0 named entries, 1 ID entries]
1033 (data @00000580)
Offset: 00617EA0
Size: 00000014
Code Page: 00000000
Reserved: 00000000

203 (next directory @00000590)

[0 named entries, 1 ID entries]
1033 (data @000005A8)
Offset: 00617EB8
Size: 00000014
Code Page: 00000000
Reserved: 00000000

204 (next directory @000005B8)

[0 named entries, 1 ID entries]
1033 (data @000005D0)
Offset: 00617ED0
Size: 00000014
Code Page: 00000000
Reserved: 00000000

205 (next directory @000005E0)

[0 named entries, 1 ID entries]
1033 (data @000005F8)
Offset: 00617EE8
Size: 00000014
Code Page: 00000000
Reserved: 00000000

206 (next directory @00000608)

[0 named entries, 1 ID entries]
1033 (data @00000620)
Offset: 00617F00
Size: 00000014
Code Page: 00000000
Reserved: 00000000

207 (next directory @00000630)

[0 named entries, 1 ID entries]
1033 (data @00000648)
Offset: 00617F18
Size: 00000014
Code Page: 00000000
Reserved: 00000000




C:WINDOWSsystem32>

[R_50Cent]

das ist sehr nützlich man sollte nur noch wissen wie man das umschreiben kann xD

[BlooD_BronD]

also den 1ten header durch den 2ten ersetzen dann die Zeile
Offset: 00617F00
Size: 00000014
Code Page: 000000
hinzufügen dann klappts

SCHERZ! ich hab keine ahnung was das darstellen soll^^