IAT is not there when on OEP: what does it mean???

#1 05-07-2005, 01:22

Hello,

I was taking a look at an application posted on another forum that is protected with Armadillo 3.60, and it seems that when on the OEP the IAT is not where expected. Not being an expert of unpacking, and for certain of Armadillo, I was curious, what might this mean (might the target been protected with any specific Armadillo feature??? might it be IAT elimination??? Something else???).

Thanks.

yaa

#2 05-07-2005, 02:24

yaa,

proberly the application has been protected with IAt elimination and/or codesplicing.
both features are described in several tutorials. Some of these tuts are posted here and some are found on Ricardo's FTP Site.

Lownoise