View Single Post
  #21  
Old 03-09-2004, 17:08
Pompeyfan
 
Posts: n/a
Not to worry mate, it is probably just me, probably hard to teach an old dog new tricks, at least you got through to me how to fix the import table, I just coudn't see the instruction that moved the first item to the iat.
Here is the error message generated by the unpacked .exe:

00410994 /$ 68 30100000 PUSH 1030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL
00410999 |. 68 AC094100 PUSH RegDefra.004109AC ; |Title = "Warning"
0041099E |. 68 B4094100 PUSH RegDefra.004109B4 ; |Text = "File corrupted ! Please run a virus-check, then re-install the application."
004109A3 |. 6A 00 PUSH 0 ; |hOwner = NULL
004109A5 |. E8 D24FFFFF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
004109AA \. C3 RETN

And references to this command:

References in RegDefra: to 00410994
Address Disassembly Comment
00410994 PUSH 1030 (Initial CPU selection)
00412D68 CALL RegDefra.00410994
00413C3E CALL RegDefra.00410994
00414569 CALL RegDefra.00410994
00415DD1 CALL RegDefra.00410994
0041680B CALL RegDefra.00410994
00416AD1 CALL RegDefra.00410994
00416FD0 CALL RegDefra.00410994
004176B6 CALL RegDefra.00410994
004176EA CALL RegDefra.00410994
004181C3 CALL RegDefra.00410994
00418A3B CALL RegDefra.00410994
00418C70 CALL RegDefra.00410994
00418CA6 CALL RegDefra.00410994
00418CDC CALL RegDefra.00410994
00418D0F CALL RegDefra.00410994
00418D42 CALL RegDefra.00410994

Is getting rid of this error message more complicated than just nopping all these calls?
Reply With Quote