Hi SvensK,
After reading lots of posts about aspr and Labba's tute, i was still getting nowhere with this target (i'm still not sure i am very far
) But then i found R@diers tute #6 - Manual unpacking ASProtect 1.23 RC4 - 1.3.08.24 and this has helped, at least now i was able to find stolen bytes, i have the same values as you, but i put oep @ 49899B and there was a nop left before the calls.
0049899B > $ 55 PUSH EBP
0049899C . 8BEC MOV EBP,ESP
0049899E . 83EC 10 SUB ESP,10
004989A1 . B8 94834900 MOV EAX,dumped_.00498394
004989A6 . 90 NOP
But target still fails to run with generating Delphi 216 runtime errors, i traced in olly to the call eax @ 40400E you mention and this execute's around in a loop and finally causes an access violation
--
bedrock