View Single Post
  #14  
Old 08-26-2004, 04:31
MaRKuS-DJM's Avatar
MaRKuS-DJM MaRKuS-DJM is offline
Cracker + Unpacker
 
Join Date: Aug 2003
Location: Virtual World / Network
Posts: 553
Rept. Given: 7
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 3
Thanks Rcvd at 16 Times in 10 Posts
MaRKuS-DJM Reputation: 6
there are different IAT-protection. mostly i saw one type which was easy to fix:

there was a msvcrt._stricmp, and after this a JE. if you change it to JMP, IAT will be auto-fixed.
to find this, set a hardware-BP on any IAT-entry and when you are at the command it is written, search up for this stricmp. good luck
Reply With Quote