|
@ ferrari ,
you need to execute the POP EAX to get the correct value of EAX,
from you Pic, you are sitting on it without running it,
use F7 to step over then tell me what the result is,
if you see in your stack frame(next to dump window)
in your pic
it is
0012FFA8 00437478 A.COPY.00437478
this is the value you need,
also i would not bother with HIEW, just use OllyDbg assemble command and insert the stolen Bytes
then do copy to executable
I hope this helps
Best Wishes
R@dier
|