|
Hi bukkake,
I enjoyed reading your solution for unpacking Visual Protect .
But almost at the finals steps I got stuck.
You said :
"Delete the thunk at RVA 00083818"
Ok I have this thunk and I can delete it.
Then you said:
"double click thunk RVA 003B00E0"
Unfortunately I don't have this thunk and I don't know what to do.
Instead I have 2 other invalids thunks which are
1-000836B8 (Has 65 invalid imports)
2-000830D0 (Has 25 invalid imports)
in short,I have 3 Invalid FThunk that I don't know what to do with them
1-000836B8
2-000830D0
3-00083818
The last one will be deleted.
So what to do with other ones.
Also the address you methined can't be found.
I mean ( 003B00E0 )
By the way,Let me know how you know the we have to delete 00083818
and why we should search for ( 003B00E0 )
I need some explanation.
Could you please let me know what your configuration in IMPREC is?
I look forward to hearing from you.
Regards,
Android.
|