Thread: PEiD and UPX
View Single Post
  #18  
Old 09-25-2005, 14:30
Peter[Pan]
 
Posts: n/a
They are both certainly UPX'D, do it manually, open them in ollydbg, and scroll down to the

POPAD
JMP ADDRESS

they are right at the bottom, just before all the 0's (not the bottom, bottom, but i mean the bottom of the code you see)

Break on the JMP ADDRESS, and step into the oep, then dump from here, and rebuild the iat.
Reply With Quote