|
Hi there
I found a little more stolen bytes than you did. Here there are:
55 PUSH EBP
8BEC MOV EBP,ESP
83EC 18 SUB ESP,18
53 PUSH EBX
56 PUSH ESI
57 PUSH EDI
33C0 XOR EAX,EAX
8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
8945 EC MOV DWORD PTR SS:[EBP-14],EAX
B8 B4FF5700 MOV EAX,dumped_.0057FFB4
After unpacking it, I also got the error message you did. But this error message is a blessing in disguise really.:-) The box ask you if you want to send a message to the author or not. And it aks you if you want to look at it. Take a look at it, and you'll find a referance to a call at the address 005807AA. By checking that out I quickly found out that by nop'ing it, the program runs fine.
I dumped the program using LordPE, not Olly.
regards,
hobgoblin
|