【发布时间】:2014-02-09 23:29:56
【问题描述】:
我有一些奇怪的东西......
我正在尝试为一个旧游戏(基于 LithTech 引擎、废弃软件、Windows 98 应用程序)做一个代理 DLL,所以我使用了 wrappit,制作了 DLL,让它编译,但是......嗯......
DLL 本身似乎没问题。至少在使用来自 OllyDbg 的 LOADDLL 进行测试时会执行 DllMain...
但是当我将它插入游戏文件夹而不是原始DLL时,它会加载DLL,然后它不会执行DLL入口点DllMain!在某些版本(Visual Studio 2005)中,它什么也没说。在其他版本(Visual Studio 2010)中,它会引发 c0000139 异常(即“找不到入口点”)。但是ollydbg中用LOADDLL正常加载怎么会找不到入口点,说明入口点到位了呢?
请帮帮我!
更新: 发布 dumpbin /exports 输出:
原来的DLL:
Microsoft (R) COFF/PE Dumper Version 10.00.30319.01
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file IMUSIC25_.DLL
File Type: DLL
Section contains the following exports for IMUSIC25.DLL
00000000 characteristics
33713027 time date stamp Thu May 08 05:45:11 1997
0.00 version
1 ordinal base
29 number of functions
29 number of names
ordinal hint RVA name
6 0 0000FD8B DllCanUnloadNow
7 1 0000FDF9 DllGetClassObject
8 2 0000FD85 DllRegisterServer
9 3 0000FD88 DllUnregisterServer
1 4 000105BD _AllocAAEngine2@8
2 5 00010507 _AllocAAEngine@4
3 6 00007101 _AllocAALoader@4
4 7 000074FC _AllocAALoaderLite@4
5 8 00010675 _AllocAAMIDIIn@4
10 9 000106A1 _GetFinalMIDISink@4
11 A 0001127F _LoadBandFile@12
12 B 000115F9 _LoadMotifFile@12
13 C 00011601 _LoadPatternFile@12
14 D 0001123C _LoadPersonalityByName@12
15 E 000111F9 _LoadPersonalityFile@12
16 F 000118F7 _LoadPersonalityFromMemory@12
17 10 0001131E _LoadSectionFile@12
18 11 000114BB _LoadSongFile@12
19 12 000111B6 _LoadStyleByName@12
20 13 00011173 _LoadStyleFile@12
21 14 0001182C _LoadStyleFromMemory@12
22 15 0001155A _LoadTemplateFile@12
23 16 000102B1 _MusicEngineSimpleInit95@12
24 17 00010497 _MusicEngineSimpleInit@12
25 18 00010066 _MusicEngineSimpleInitNT@12
26 19 000119C2 _Panic@4
27 1A 00011465 _SaveSectionAsMIDIFile@8
28 1B 000113E1 _SaveSectionFile@8
29 1C 00010692 _SetAADebug@4
Summary
4000 .data
1000 .idata
1000 .rdata
2000 .reloc
1000 .rsrc
1B000 .text
我制作的 DLL:
Microsoft (R) COFF/PE Dumper Version 10.00.30319.01
Copyright (C) Microsoft Corporation. All rights reserved.
Dump of file IMUSIC25.DLL
File Type: DLL
Section contains the following exports for imusic25.dll
00000000 characteristics
52F816DB time date stamp Mon Feb 10 04:01:31 2014
0.00 version
1 ordinal base
30 number of functions
30 number of names
ordinal hint RVA name
6 0 00001020 DllCanUnloadNow = ___E__0__@0
7 1 00001030 DllGetClassObject = ___E__1__@0
8 2 00001040 DllRegisterServer = ___E__2__@0
9 3 00001050 DllUnregisterServer = ___E__3__@0
2 4 00001060 _AllocAAEngine = ___E__5__@0
1 5 00001130 _AllocAAEngine2 = ___E__4__@0
3 6 00001070 _AllocAALoader = ___E__6__@0
4 7 00001080 _AllocAALoaderLite = ___E__7__@0
5 8 00001090 _AllocAAMIDIIn = ___E__8__@0
30 9 00001000 _DllMain@12 = _DllMain@12
10 A 000010A0 _GetFinalMIDISink = ___E__9__@0
11 B 000010B0 _LoadBandFile = ___E__10__@0
12 C 000010C0 _LoadMotifFile = ___E__11__@0
13 D 000010D0 _LoadPatternFile = ___E__12__@0
14 E 000010E0 _LoadPersonalityByName = ___E__13__@0
15 F 000010F0 _LoadPersonalityFile = ___E__14__@0
16 10 00001100 _LoadPersonalityFromMemory = ___E__15__@0
17 11 00001130 _LoadSectionFile = ___E__4__@0
18 12 00001110 _LoadSongFile = ___E__17__@0
19 13 00001120 _LoadStyleByName = ___E__18__@0
20 14 00001130 _LoadStyleFile = ___E__4__@0
21 15 00001150 _LoadStyleFromMemory = ___E__20__@0
22 16 00001160 _LoadTemplateFile = ___E__21__@0
24 17 00001180 _MusicEngineSimpleInit = ___E__23__@0
23 18 00001170 _MusicEngineSimpleInit95 = ___E__22__@0
25 19 00001190 _MusicEngineSimpleInitNT = ___E__24__@0
26 1A 000011A0 _Panic = ___E__25__@0
27 1B 000011B0 _SaveSectionAsMIDIFile = ___E__26__@0
28 1C 000011C0 _SaveSectionFile = ___E__27__@0
29 1D 000011D0 _SetAADebug = ___E__28__@0
Summary
1000 .data
1000 .rdata
1000 .rsrc
1000 .text
UPD:我检查了失败的 LoadLibraryA 调用上的“GetLastError” - 它是 0x1E7 (487) - ERROR_INVALID_ADDRESS
【问题讨论】:
-
你能把
dumpbin /exports orginal.dll和dumpbin /exports your.dll的结果贴出来吗? -
是的,当然 - 我已经更新了问题的文本。
-
现在我检查我注意到出口是不同的......他们似乎缺少“@4”和类似的部分!但在我的 def 文件中,它们存在!好像被剥光了?!
-
好吧,我设法通过更改函数的定义并使它们与原始函数一样来解决这个问题。我还需要在项目设置中设置重定位。这一切都有帮助。感谢您指导我检查出口并感谢这个答案:stackoverflow.com/questions/2804893/…(对于@wqw 的答案)案例已结束。