Differences

This shows you the differences between two versions of the page.

--- windowsdlls [2009/09/27 09:18] – nopsled
+++ windowsdlls [2010/04/29 14:48] (current) – megadiscman
@@ Line 238: / Line 238: @@
 The OCM files (except for init.ocm which contains an extra layer of packing) are interpreted as [[OCMBytecode]]
-Here is a decode for native code blocks from OCM files. It is severe works-for-me-quality, having at least the following issues:
+Here is a decoder for native code blocks from OCM files. It is severe works-for-me-quality, having at least the following issues:
   * It does not name imports from salwrap, it just puts offsets into the import table into a generic name. Check here for some name [[OCMSalwrapExports]]
   * It is unable to parse named exports
@@ Line 245: / Line 245: @@
 The output of the program is an assembler source file (completely unreadable) that is intended to be compiled by the GNU assembler (Win32 port or cross-assembler in linux) and then loaded into a good disassembler, like IDA 4.9 Freeware for example.
-[[codeblockparser]]
+[[codeblockparser]] (the format of the codeblocks is in [[codeblockformat]])
 Some info about analysing an OCM file can be found in this part of chat log:
@@ Line 255: / Line 255: @@
   * Netmd.ocm: [[netmdocm]]
   * Device.sal: [[devicesal]]
+  * Trkinf: [[trkinfocm]]
 ===== Links =====
   * [[http://newgre.net/antire]] - Anti-Reverse Engineering Techniques in DRM Code