![]() |
|
#7
|
|||
|
|||
|
Have you tried standard stack hr bpx? you can then obtain OEP.
If it is a standard packer (upx, asp, etc.) just bpx in IAT, take notice of instruction writing at IAT, rerun and brak at it. Then dump (original IAT will be kept), fix with found OEP, alter IAT pointers with LordPE to point the unscrewed/virgin IAT et voil�� (ImpREC might help you locating real IAT size, I think). Regards, Maximus (btw I found NOP+PUSHAD+CALL in some AsPack EP version) |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| "Error while unpacking program, code LP5. Please report to author." | gokilaravee | General Discussion | 2 | 06-01-2011 14:34 |