03-16-2005 post corrections:
Quote:
|
I'm testing a fix to the 5.3.1071 AM release.
|
Ok, that is a mistake, it is the 5.3.1078.
Now, I am testing with the tool all releases I have found.
Quote:
|
But it is a very good beginning getting the "18 Wheels of Steel - Pedal to the Metal". This is the only one (I have found till today) of the 5.3.1071 AM release that keep in the dumped code the equivalences for the AM calls that you can find inside the dumped code as:
|
Ok, that has changed. I have found lots of targets that keep the AM equivalences table.
Quote:
|
The 'PEStub' string an then six 0 bytes, then the equivalence table begins. If not try point 2
|
Well, in the 5.3.1078 you always find the AM equivalences table following the PEStub string plus six zero bytes. The other options work for another previous AM releases to this 5.3.1078.
And in the same post, some "not call" that are to be "nop call".
Cheers!
Nacho_dj