View Single Post
  #3  
Old 11-29-2003, 20:54
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
in programs packed by the demo ,I found out that breaking at mov dword ptr ds:[edi],eax in the packer code,
and following [edi] address in the dump, will get u the whole
Iat nice and clean . so copying that and repasting it back
once u stop on the oep, ImpoRTrec will solve it all. I
tested it with Iat from the program before protecting it,
and both are exactly the same. so as I said before for
us to unpack your program we need the packer registered
version to learn from.

britedream

Last edited by britedream; 11-29-2003 at 21:08.
Reply With Quote