View Single Post
  #2  
Old 05-26-2005, 20:11
Spiteful
 
Posts: n/a
look at VA 5DB39Ch, this dword contains OEP RVA (173118), so change replace it with 80 (address after DOS stub)
Now, you can add your byte replacement code at 400080h
Reply With Quote