Thread: ActiveM***
View Single Post
  #13  
Old 03-10-2005, 19:35
imagin
 
Posts: n/a
Yes - difference is and among dumper with LordPE and PETOOLS - but it will not the main problem - largely problem why programme falls is according to to me in instruction NOP,CALL which must repair !!!(packer AM patching norm.instr.CALL to NOP,CALL) - but which and who repair this???
(have you in his dump API - LoadLibraryA??)

Code:
EXAMPLE:
004014BD    90              NOP
004014BE    90              NOP
004014BF    90              NOP                        -----/ 
004014C0    E8 58C21100     CALL    Dumped2_.0051D71D  -----/wrong CALL
004014C5    85C0            TEST    EAX, EAX
004014C7    74 24           JE      SHORT Dumped2_.004014ED
004014C9    8B10            MOV     EDX, DWORD PTR DS:[EAX]

Last edited by imagin; 03-17-2005 at 03:21.
Reply With Quote