look closely here at image2, I think you'll know that 401380 seems like a good oep; not 40137a.
sure.. but i never said 40137a was a good OEP .. i just used to get the IAT then i wrote back 401380 to Imprec wich Insert good OEP automatically .. or you can do it by hand/manually
since at the right place OEP should be only contain 909090.. data .. Imprec interprete this as invalid OEP .. but if you wrote as OEP where the last JMP API call is Imprec will read this place as valid OEP and will find almost all correct API jumps for IAT
07-02-2004, 09:00
Threaded Mode