Thread: Visual Protect
View Single Post
  #9  
Old 09-15-2004, 15:35
Android
 
Posts: n/a
Hi bukkake,
I enjoyed reading your solution for unpacking Visual Protect .
But almost at the finals steps I got stuck.

You said :
"Delete the thunk at RVA 00083818"
Ok I have this thunk and I can delete it.
Then you said:
"double click thunk RVA 003B00E0"
Unfortunately I don't have this thunk and I don't know what to do.
Instead I have 2 other invalids thunks which are

1-000836B8 (Has 65 invalid imports)
2-000830D0 (Has 25 invalid imports)




in short,I have 3 Invalid FThunk that I don't know what to do with them

1-000836B8
2-000830D0
3-00083818

The last one will be deleted.
So what to do with other ones.
Also the address you methined can't be found.
I mean ( 003B00E0 )

By the way,Let me know how you know the we have to delete 00083818
and why we should search for ( 003B00E0 )

I need some explanation.

Could you please let me know what your configuration in IMPREC is?

I look forward to hearing from you.
Regards,
Android.
Reply With Quote