|
in programs packed by the demo ,I found out that breaking at mov dword ptr ds:[edi],eax in the packer code,
and following [edi] address in the dump, will get u the whole
Iat nice and clean . so copying that and repasting it back
once u stop on the oep, ImpoRTrec will solve it all. I
tested it with Iat from the program before protecting it,
and both are exactly the same. so as I said before for
us to unpack your program we need the packer registered
version to learn from.
britedream
Last edited by britedream; 11-29-2003 at 21:08.
|