ActiveM***

[Nacho_dj]

Another issue of AM protection is the one related to functions and dll's.

AM protection removes some of the functions provided in the import table by the original program. So, in order to rebuild the program, you will need adding these lost functions (api's), or even, some dll.

It happens in functions such as Direct3DCreate8, belonging to d3d8.dll. When a nop + call is referencing to it, the rebuilding of this function has to include the insertion of the function in the import table, and, if no present, of the dll.

I do not know whether there is a tool doing this. I have included this function in the rebuilder I am developping, but it has been a difficult task.


When tracing the nop + call redirection, you can get a LoadLibrary "d3d8.dll", and then, GetProcAddress of "Direct3DCreate8".

So, another issue that has to be fixed...


Cheers

Nacho_dj