The new svkp 143

[britedream]

I did check it today and found that table and stolen is the same way as in earlier versions, but svkp now changed the indirect address to other address- ExitProcess I think- so there is a table for this that solve this problem as the one below:



009C8DCB 00 00 00 00 B8 C0 40 00 ....&cedil;&Agrave;@. <--- First address
009C8DD3 95 AD 40 00 20 C1 40 00 •­@. &Aacute;@.
009C8DDB 24 AD 40 00 C0 C0 40 00 $­@.&Agrave;&Agrave;@.
009C8DE3 FF AC 40 00 C0 C0 40 00 &yuml;&not;@.&Agrave;&Agrave;@.
009C8DEB 97 AC 40 00 C0 C0 40 00 ��&not;@.&Agrave;&Agrave;@.
009C8DF3 64 AC 40 00 58 C1 40 d&not;@.X&Aacute;@



this is part of the table, the first address-0040c0b8-is the correct address to the iat, the second address is the address where the first address to be moved to correct the problem, so if you make script with a command to mov the first to the second, the problem should be solved,this is what time permit,sorry I didn't have time to write a script to test it , but I think it is easy , this is the only problem I can see now, if any other problem occur please let me know thanks.
[note1]
the last 6 or so addresses are non linear, script can also find them but slightly different way.
[note2]
on top of the ExitProcess indirection there is MessageBox indirection and can be found at the same way as the ExitProcess from within the same table area..
it also changes some of the api move to call ,as ex.: mov ebp, [an api address] ; some code;then call ebp, svkp changes this to call [an api address]; some code; call ebp. it is not limited to ebp it can be esi or edi etc ..
to correct this change the call to mov .