|
the only thing 'special' i saw with this particular app is that it uses int41 to detect debuggers.
works like this:
mov eax,04F
int 41
cmp ax,0F386
je debugger_detected
and it kills olly in the int41.
so that may be your problem. this is very easy to overcome, obviously, you can just nop these commands and have it flow the way you want.
|