Thread
:
Armadillo Import Elimination
View Single Post
#
2
09-26-2004, 23:47
xzz
Posts: n/a
....
if its only one api call, wrong placed you can fix it simple,
look your last iat area find the "ReqQuerryValueEx" where placed (on rva)
then patch islike this (opcode)
FF25xxxxxxxx (the xx is rva + imagebase then inverted e.g FF25B3A14000)
xzz