|
here is the oep and stolen bytes:
00459876 55 PUSH EBP
00459877 8BEC MOV EBP,ESP
00459879 6A FF PUSH -1
0045987B 68 F8944700 PUSH SpeedCom.004794F8
00459880 68 969B4500 PUSH SpeedCom.00459B96 ; JMP to MSVCRT._except_handler3
00459885 50 PUSH EAX
00459886 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0045988C 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
00459893 83EC 68 SUB ESP,68
00459896 53 PUSH EBX
00459897 56 PUSH ESI
00459898 57 PUSH EDI
00459899 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0045989C 33DB XOR EBX,EBX
0045989E 895D FC MOV DWORD PTR SS:[EBP-4],EBX
004598A1 6A 02 PUSH 2
Last edited by britedream; 12-27-2003 at 22:16.
|