![]() |
|
#4
|
|||
|
|||
|
Ihad experienced your case.
In my case, I remaked new IAT. First check the code. 00A7EA9E FF15 3461A800 CALL DWORD PTR DS:[A86134] A86134 is virtual table of armadillo. Set hardware breakpoint at 00A7EA9E+2. //00A7EAA and trace.. 3461A800<--- Armadillo patched code (Original code? I don't know..) so You can find like this Mov CS:[EAX],ECX jmp yyyyyy // It will patch all code that access IAT. KK: //end address of routine EAX is 00A7EAA, & ECX is 00A86134 if you know ollyscript, you can make some script. bp xxxxxx bp kk l_start: esto log eax log ecx cmp eip,kk jne l_start ret then you will get like this log msg XXXXXXXX Breakpoint at XXXXXXXX eax = 00402C02 mem0 = 77E61BEA | kernel32.Sleep and You have to make your own IAT maually or not. (Some Address pointed Virtual table, you can trace and repair!!) Sorry My english is so poor.. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| SDK 11.14 Demo setup giving trouble :( | Gede | General Discussion | 6 | 03-17-2024 10:44 |
| CreateProcess giving wrong ProcessID/ThreadID | MarkusO | General Discussion | 1 | 11-05-2006 04:12 |
| C4033 trouble. | pigman | General Discussion | 1 | 08-09-2004 02:10 |
| Trouble to access the FTP server | donneraza | General Discussion | 1 | 11-18-2003 00:14 |