@ SatyricOn:
Quote:
|
Hmm. This is not acceptable.. This would move whatever data was [EBX] to [EAX], overwriting whatever was there already (the value in EBX, at this point), which may be something critical (like an IAT entry).
|
Of course you're right... I don't know what I've thought when I did this change. Ok, it was late and I was tired
Quote:
|
Standard procedure here is just to NOP the instructions at 578919 and 57891E.
|
I see. And again: learned something new
Quote:
|
I use Visual Studio, but a small app like ResHack or something should do the trick, too. That's a fairly small download, I think. Any resource editor should work; there are many out there, and most are free.
|
Perhaps you're right, but till now I couldn't figure out how to use ResourceHacker for that kind of task. I'll try to google another resource editor. Perhaps I'll find an appropriate one!
@ britedream:
Your help is much appreciated, but I'm not sure if I understand you:
Quote:
|
you should bp 578911 in the orignal and follow the [40781e] to find the correct value. on your pc 578911 is the correct address for code that I changed in my earlier post.
|
I've compared the value of [40781E] in the original file with that in the dumped one. Both are the same. So, basically, it should make no difference if I replace
00578911 MOV EAX,DWORD PTR DS:[40781E] ; [40781E] contains 62A43C
with
00578911 MOV EAX,62A43C
Could you please explain what I'm getting wrong here?
Regards
Wurstgote