|
1. upx -d works perfectly. If your exe doesnt run after, it's because of an integrity check. Debug it.
2. your OEP is right, but I dont know how you arrive at those IAT numbers. Using the same scylla version as you, scylla correctly finds the entire IAT with VA:004AE5C0 and Size:0000042C.
3. Hint: For the integrity check, look around 0x00489BC6.
Once the integrity check is patched, the unpacked file works.
|