Thread: Armadilled apps
View Single Post
  #5  
Old 01-29-2005, 00:32
Eggi
 
Posts: n/a
thats not true for armadillo.... peid says armadillo 3.78 if it uses the layer from the adata section as ep (ep is a pushad then)

but if a author uses minimum protection it will have a push ebp at the ep and so peid will identify it as 1.x - 2.x also if its a newer version...
Reply With Quote