Dll relocation finder

DLL Relocation Finder : command-line Tool to detect and list Relocated DLLs in the Process DLL Relocation Finder See Also Contents About How to use? Screenshots Release History Download New v1.5 About DLL Relocation Finder is the command-line Tool to detect and list Relocated DLLs in the Process. Every DLL specifies a base address where it should be mapped during load time. However if that address is occupied by some other DLL then this DLL has to be relocated to new base address. This is called DLL Relocation or DLL Rebasing. This relocation process also happens for ASLR enabled modules. In such cases, DLL Relocation Finder helps you to find these relocated DLLs and their new addresses. It also provides option to list only relocated or non-relocated or both type of DLLs. Here are some of the practical observations w.r.t DLL Relocation On pre-Vista systems (winxp, win2k3) very few DLLs are relocated On post-Vista systems (vista, win7, win8) almost all the DLLs are relocated Also majority of the system DLLs are relocated to same new address across different processes (may vary in certain cases). Being a command-line tool makes it easy to automate through scripting. Also it can be useful tool for researchers & developers. It is fully portable and contain separate versions for 32-bit and 64-bit systems.It works on all the platforms starting from Windows XP to Windows 8. Installation & Un-installation DLLRelocationFinder comes with Installer to help in local installation & un-installation. This installer has intuitive wizard which guides you through series of steps in completion of installation. At any point of time, you can uninstall the product using the Uninstaller located at following location (by default) [Windows 32 bit] C:\Program Files\SecurityXploded\DLLRelocationFinder[Windows 64 bit] C:\Program Files (x86)\SecurityXploded\DLLRelocationFinder --> How to use? DLL Relocation Finder is very easy to use tool. It is command-line/console based tool, hence you have to launch it from the command prompt (cmd.exe). Here is the simple usage information [For 32-bit Systems] DLLRelocationFinder32.exe [-r | -n] [ | ] [For 64-bit Systems] DLLRelocationFinder64.exe [-r | -n] [ | ] Examples of DLL Relocation Finder //Show

Moderators: DllAdmin, DLLADMIN ONLY aqueous Posts: 8 Joined: 06 Apr 2009, 23:00 illegal system dll relocation I have a blue screen with this message: STOP: 0000269 illegal system dll relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address range reserved for windows systems DLLs The vendor should %%" I dont know how to troubleshoot this. Background: ran chkdisk as a routine maintenance. XP went to endless reboot. i tried booting from original XP disk, going to recovery console and I guess reinstalling kernel32.dll. still cycling. i am unable to reach safe mode but advanced options menu allows me to disable automatic restart so i could see the blue screen warning. Going to las known configuration has no effect. i have SP2 XP home edition. What do i do now? lem Posts: 12 Joined: 03 Apr 2009, 23:00 Re: illegal system dll relocation Post by lem » 07 Apr 2009, 18:18 Aqueous wrote:> I have a blue screen with this message: STOP: 0000269 illegal system dll > relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address > range reserved for windows systems DLLs The vendor should %%" I dont know > how to troubleshoot this. Background: ran chkdisk as a routine maintenance. > XP went to endless reboot. i tried booting from original XP disk, going to > recovery console and I guess reinstalling kernel32.dll. still cycling. i am > unable to reach safe mode but advanced options menu allows me to disable > automatic restart so i could see the blue screen warning. Going to las known > configuration has no effect. i have SP2 XP home edition. What do i do now?> > Try the following:1. boot from a Windows CD and go to recovery console.2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old gdi32.dll in c:\windows\system32 directory)3. Reboot normally-- Lem -- MS-MVPTo the moon and back with 2K words of RAM and 36K words of ROM. aqueous Posts: 8 Joined: 06 Apr 2009, 23:00 Re: illegal system dll relocation Post by aqueous » 07 Apr 2009, 19:26 Thanks.i need a little more hand-holding,sorry to say. i am now

In a dos environment looking at a c:\windows> prompt. (I chose windows but it could have been D:\i386). The instructions i followed before to reinstall kernel32 dll were >cd system 32 then >ren [names of files, new and old] and then >map. Then there was an expand command, and exit. I just followed the directions by rote but dont know exactly what i executed with this, so that is my level of understanding. i am just guessing that the dos command for copy is "copy" and i have no idea how to navigate to the place i want to copy to, or what the command for, um, paste? is. Can you give me step by step directions from the point of having the c: prompt in Recover console? i apologize for my ignorance and am grateful for your help."Lem" wrote:> Aqueous wrote:> > I have a blue screen with this message: STOP: 0000269 illegal system dll > > relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address > > range reserved for windows systems DLLs The vendor should %%" I dont know > > how to troubleshoot this. Background: ran chkdisk as a routine maintenance. > > XP went to endless reboot. i tried booting from original XP disk, going to > > recovery console and I guess reinstalling kernel32.dll. still cycling. i am > > unable to reach safe mode but advanced options menu allows me to disable > > automatic restart so i could see the blue screen warning. Going to las known > > configuration has no effect. i have SP2 XP home edition. What do i do now?> > > > > > Try the following:> > 1. boot from a Windows CD and go to recovery console.> > 2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to > c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old > gdi32.dll in c:\windows\system32 directory)> > 3. Reboot normally> > -- > Lem -- MS-MVP> > To the moon and back with 2K words of RAM and 36K words of ROM.> aqueous Posts: 8 Joined: 06 Apr 2009, 23:00 Re: illegal system dll relocation

Post by aqueous » 07 Apr 2009, 19:58 Lem, belay that last post, i am teaching myself DOS, kind of... I know how to copy the file, but there is no such file on c: and no i386folder on c: either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_should i copy the DL_ file only and place it in the c: location you indicated? "Lem" wrote:> Aqueous wrote:> > I have a blue screen with this message: STOP: 0000269 illegal system dll > > relocation kernel32.dll ...C:windows/system32/GDI32.dll occupied an address > > range reserved for windows systems DLLs The vendor should %%" I dont know > > how to troubleshoot this. Background: ran chkdisk as a routine maintenance. > > XP went to endless reboot. i tried booting from original XP disk, going to > > recovery console and I guess reinstalling kernel32.dll. still cycling. i am > > unable to reach safe mode but advanced options menu allows me to disable > > automatic restart so i could see the blue screen warning. Going to las known > > configuration has no effect. i have SP2 XP home edition. What do i do now?> > > > > > Try the following:> > 1. boot from a Windows CD and go to recovery console.> > 2. Copy gdi32.dll from c:\windows\servicepackfiles\i386\gdi32.dll to > c:\windows\system32\gdi32.dll. (Do keep a backup copy of the old > gdi32.dll in c:\windows\system32 directory)> > 3. Reboot normally> > -- > Lem -- MS-MVP> > To the moon and back with 2K words of RAM and 36K words of ROM.> lem Posts: 12 Joined: 03 Apr 2009, 23:00 Re: illegal system dll relocation Post by lem » 08 Apr 2009, 06:01 Aqueous wrote:> Lem, belay that last post, i am teaching myself DOS, kind of... I know how > to copy the file, but there is no such file on c: and no i386folder on c: > either. on the cd drive (e in my case) i found I386\GDI32.DL_ and GDI.EX_> should i copy the DL_ file only and place it in