|
to go to oep you don't have set bp on retn , you can set the memory bp on access on the code section while you are on the last exception, use the bp on retn only for trace.(check my last script)
2- my new signature for correcting the IAT is one byte less than my old one, which misses some times.the new one is = 8B 17 89 02 . this is more reliable
Last edited by britedream; 04-30-2004 at 09:48.
|