I just ran across something quite strange today. I am examining the target TheaterTek 2.11 with OllyDbg.

I have HideDebugger and the OutputDebugStringA patch installed. I also renamed Ollydbg.exe to "this.exe"

When I examine the code with Version 2.0 of TTek, I find there are 3 subroutines concerning ArmAccess. VerifyKey, InstallKey, and EnvironmentUpdate.

When I step through version 2.0 these routines confirm LoadLibraryA of armaccess.dll (inside the packed exe) and it jumps into the 39xXXX range which is where the Armadillo code is located within TTek 2.0.

This is good. Now here is where it changes.

I installed the 2.11 patch and now the same 3 routines fail to LoadLibraryA of armaccess.dll. Matter of fact there are a bunch of CALL ESI routines for checking USERNAME, USERKEY that no longer point to the 39xXXX range. They now show CALL ESI; kernel32.GetEnvironmentVariableA.
*NOTE: When you unpack the armadillo .exe file these CALL ESI do show as kernel32.GetEnvironmentVariableA, but never inside the original packed code till now.

When you close Olly and execute the original 2.11 exe file, it does check the ArmAccess information.

Does anyone know why the original packed Armadillo .exe would no longer point towards the internal Armadillo code between 2 versions of the program?

PeID .93 reports Armadillo 3.78

Any help would be appreciated.