|
|
#8
03-05-2005, 00:34
|
|||
|
|||
|
Well, I took my old target (protected with ActiveMark 5.3) and gave it a look. I dumped it at the browser window and searched the famous string. Result is in the image attached. The dword highlighted is the RVA of the 2nd layer's EP.
Hero's target has a bit different pattern because it's an old version of the packer (2.7...), the strings are still there but in a different position. You can check packer version running protected apps with this arg "--AmClientVersion" (without quotes). Regards, SystemeD PS: I edited my previous post because it was wrong... Last edited by SystemeD; 03-05-2005 at 00:57. Reason: Problem with attachment... 
|
| Thread Tools | |
| Display Modes | |
|
|
Threaded Mode