View Single Post
  #1  
Old 01-22-2004, 04:57
MaRKuS-DJM's Avatar
MaRKuS-DJM MaRKuS-DJM is offline
Cracker + Unpacker
 
Join Date: Aug 2003
Location: Virtual World / Network
Posts: 553
Rept. Given: 7
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 3
Thanks Rcvd at 16 Times in 10 Posts
MaRKuS-DJM Reputation: 6
if you used the "tc eip<900000", you have to dump after this command (you should be at a jump-command, wich jumps into some code which executes a kernel32.GetModuleHandleA)

then edit the EP with LordPE or any other tool to real OEP but do not dump later or dump will crash (it does for me)

Regards,
MaRKuS TH-DJM
Reply With Quote