View Single Post
  #13  
Old 06-23-2004, 04:52
hobgoblin hobgoblin is offline
Friend
 
Join Date: Jan 2002
Posts: 124
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 5 Times in 5 Posts
hobgoblin Reputation: 0
Agree

I agree that the basic idea you're outlining will work.(I have done a similar thing in my patch).
But I think using the address at 0063C4B2 is too early. When you arrive at that code (location) the program isn't properly unpacked yet, and that the unpacking process that follows this jump will overwrite what you previously have patched. In my patch I used the first jump after the decryption is done, and that works (as a starting point for further patching/redirection).

regards,
Reply With Quote