Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #4  
Old 12-30-2004, 16:05
OrionOnion
 
Posts: n/a
Smile

Ihad experienced your case.
In my case, I remaked new IAT.

First check the code.

00A7EA9E FF15 3461A800 CALL DWORD PTR DS:[A86134]

A86134 is virtual table of armadillo.


Set hardware breakpoint at 00A7EA9E+2. //00A7EAA
and trace..
3461A800<--- Armadillo patched code (Original code? I don't know..)
so You can find like this

Mov CS:[EAX],ECX
jmp yyyyyy // It will patch all code that access IAT.
KK: //end address of routine

EAX is 00A7EAA, & ECX is 00A86134
if you know ollyscript, you can make some script.

bp xxxxxx
bp kk
l_start:
esto
log eax
log ecx
cmp eip,kk
jne l_start
ret

then you will get like this log msg
XXXXXXXX Breakpoint at XXXXXXXX
eax = 00402C02
mem0 = 77E61BEA | kernel32.Sleep

and You have to make your own IAT maually or not.
(Some Address pointed Virtual table, you can trace and repair!!)

Sorry My english is so poor..
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SDK 11.14 Demo setup giving trouble :( Gede General Discussion 6 03-17-2024 10:44
CreateProcess giving wrong ProcessID/ThreadID MarkusO General Discussion 1 11-05-2006 04:12
C4033 trouble. pigman General Discussion 1 08-09-2004 02:10
Trouble to access the FTP server donneraza General Discussion 1 11-18-2003 00:14


All times are GMT +8. The time now is 06:37.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )