![]() |
|
#2
|
|||
|
|||
|
Code:
mov eax,fs:[000000018h] //TEB mov eax,[eax+030h] //PEB mov [eax+008h],ecx //rewrite old imagebase mov eax,[eax+00Ch] mov eax,[eax+00Ch] // <-- error, that's why :) mov [eax+018h],ecx //rewrite old imagebase
|
|
|