|
|
|
|
#1
01-02-2006, 12:18
|
|||
|
|||
|
Yeah, that one doesnt work for me. It crashes with an access violation:
0052D2A9 . E8 C4000000 CALL <JMP.&msvcrt._initterm> ---> 0041AC3C . FF15 3C335500 CALL NEAR DWORD PTR DS:[55333C] ; Unpacked.00F87A4B ---> 77D48E00 C17412 39 0E SAL DWORD PTR DS:[EDX+EDX+39],0E Crashing : Trying to reach EF8A3609 It doesnt reach the correct API. I compared yours with mine and they are different here : 00F87A4B - E9 B013DC76 JMP USER32.77D48E00 -- Yours 00EB7A4B - E9 D813E876 JMP USER32.RegisterWindowMessageA - Mine Actually none of the USER32 APIs are found. Im sitting on WinXPSP2 btw. 
|
|
#2
01-02-2006, 22:39
|
|||
|
|||
|
svkp goes from 0012xxxx to some other section:
(example from some VC unpackme with oep elimination ): 02DAE159 81C5 991DAD6D ADD EBP,6DAD1D99 02DAE15F 50 PUSH EAX 02DAE160 /E9 AE000000 JMP 02DAE213 Problem are encrypted sections not imports ... Last edited by hosiminh; 01-02-2006 at 22:56.
|
 |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| svkp | infern0 | General Discussion | 3 | 06-05-2011 18:34 |
| SVKP 1.3x unpacking | codeX | General Discussion | 10 | 01-28-2005 22:03 |
| The new svkp 143 | britedream | General Discussion | 3 | 09-19-2004 22:22 |
Hybrid Mode
