Thread: ActiveM***
View Single Post
  #26  
Old 05-30-2005, 23:12
Nacho_dj's Avatar
Nacho_dj Nacho_dj is offline
Lo*eXeTools*rd
 
Join Date: Mar 2005
Posts: 211
Rept. Given: 16
Rept. Rcvd 179 Times in 34 Posts
Thanks Given: 44
Thanks Rcvd at 137 Times in 41 Posts
Nacho_dj Reputation: 100-199 Nacho_dj Reputation: 100-199
following the rebuilding...

Another issue of AM protection is the one related to functions and dll's.

AM protection removes some of the functions provided in the import table by the original program. So, in order to rebuild the program, you will need adding these lost functions (api's), or even, some dll.

It happens in functions such as Direct3DCreate8, belonging to d3d8.dll. When a nop + call is referencing to it, the rebuilding of this function has to include the insertion of the function in the import table, and, if no present, of the dll.

I do not know whether there is a tool doing this. I have included this function in the rebuilder I am developping, but it has been a difficult task.


When tracing the nop + call redirection, you can get a LoadLibrary "d3d8.dll", and then, GetProcAddress of "Direct3DCreate8".

So, another issue that has to be fixed...


Cheers

Nacho_dj
Reply With Quote