View Single Post
  #12  
Old 06-03-2004, 00:37
Barry Barry is offline
Friend
 
Join Date: Dec 2003
Posts: 84
Rept. Given: 10
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Barry Reputation: 2
Success!!

I think this is more luck than skill though

I loaded the EXE into IDA and searched for GetVersion/GetVersionExA, my friend said 95% of the time that's roughly how to find the program start, but not always, something to do with C/C++ compiled programs! So after finding a couple of places that called GetVersionExA and noting the addresses I then loaded the EXE into LordPE went to the Import Table and found the entries for the second import table and used 'kill ImageImportDescriptor' to kill those additional entries so they were not called anymore.

I then changed the EntryPoint in turn to the addresses I noted in IDA and got the program running, I deleted the DLL to make sure and the program runs fine This method is probably unique to this program, but I've learned something in doing so, probably all bad practice no doubt and some of you will probably be cringing with disgust at my crude methodolgy, but hey, I managed to achieve my goal
Reply With Quote