|
Yes I dumped the demo version from the site, also remember that first call you stop on is the ThunRTMain, so below that just find the string VB5!6 this is the address for the push. As for the DLL, as I said before, just create a DLL named special.dll, make 1 function exported named SVKP_KillDebugger,
and make another function to grab the PID, get the address of CryptVerifySignature, and write to that address something like
mov eax, 01
retn 18.
Also a note .. if your dumped file isnt the same name as the org program, change it to it.
Last edited by mtw; 07-02-2004 at 23:38.
|