Armadillo & Armaccess Question

[D-Jester]

Originally Posted by TmC

So it is not needed to dump armaccess.dll but it is needed to restore some of the variables.

Oh I know it isn't necessary. I have been playing with arm for awhile now I understand the whole patching etc...

I was just wandering how (if I wanted to) would I go about finding Armacces.dll in memory after the program extracts it. I was just wandering if a method exisited before I played with it.

[TmC]

Well an idea could be to extract it from armadillo itself. If you unpack it, you will notice that in the resource section there are 5 versions of Armaccess.dll (1 for dll, one for maximum protection, one for standard protection and other 2 don't know).

Those are the fully functional dlls, not just the fake one distributed by sr.

To play with it in memory i believe it could be set a bp on LoadLibrary and see the address it is called...just an idea...