Quote:
Originally posted by britedream
Ok, I will put your mind at ease. at the first exception search for "8b178902eb", right above that, are two calls bp on the last one, go on with shif+f9 till you reach it, nope it this will almost fix your table, and you should see the instruction right below you, moving the first item to the iat, which confirm what I told you and the stripper finding as you posted.
|
I am afraid Britedream but my brain fail to process this one
This may be a dumb ? but i wud rather dare ask it then remain one.
Okay i start it fresh in olly. At first exception i hit Ctrl B
and enter 8b178902eb. I land here
009A32B4 E8 47FCFFFF CALL 009A2F00
009A32B9 E8 7EFEFFFF CALL 009A313C
009A32BE 8B17 MOV EDX,DWORD PTR DS:[EDI]
009A32C0 8902 MOV DWORD PTR DS:[EDX],EAX
009A32C2 EB 7E JMP SHORT 009A3342
009A32C4 83FB 06 CMP EBX,6
009A32C7 74 05 JE SHORT 009A32CE
009A32C9 83FB 03 CMP EBX,3
009A32CC 75 37 JNZ SHORT 009A3305
Quote:
Originally posted by britedream
nope it this will almost fix your table,
|
I put BP at 009A32B9 and hit shift+f9 until i reach there. Then m i supposed to NOP it. And if yes then what should i do next. Plz can u elaborate as why u do all this. i mean how got this-->"8b178902eb" and why put bp and why nop it.
Plz if possible
