|
Hi Markus,
the stolen bytes and Iat are not correct, your program is working on the following info.:
005B6CCC > $ 55 PUSH EBP
005B6CCD . 8BEC MOV EBP,ESP
005B6CCF . 83EC 0C SUB ESP,0C
005B6CD2 . 53 PUSH EBX
005B6CD3 . B8 BC645B00 MOV EAX,dd_.005B64BC
here is the iat:
Last edited by britedream; 12-29-2003 at 12:38.
|