|
I can tell you for sure that on my dump, it made no difference at all; I got the same exception at 57891E as I did when it was moving [40781E] to EAX. After all, since both the original code and your suggested change moves 62A43C to EAX, EBX gets the value 77E7AD86 either way, and so 57891E tries to POP/write to kernel32 either way.
Maybe you and I produced different dumps?? I don't know what else could cause your changing the instruction at 578911 to MOV EAX,62A43C to fix the access violation..?
Regards
|