Exetools  

Go Back   Exetools > General > Source Code

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-09-2016, 00:16
evlncrn8 evlncrn8 is offline
VIP
 
Join Date: Sep 2005
Posts: 179
Rept. Given: 36
Rept. Rcvd 54 Times in 24 Posts
Thanks Given: 50
Thanks Rcvd at 118 Times in 70 Posts
evlncrn8 Reputation: 54
.ooa section is just origin, no denuvo implied and are you just assuming .net entrypoint cos of the ff 25 jmp to activation.dll (its not .net at all)
Reply With Quote
The Following User Says Thank You to evlncrn8 For This Useful Post:
tonyweb (12-17-2016)
  #2  
Old 12-17-2016, 17:59
n00b n00b is offline
Friend
 
Join Date: Mar 2009
Posts: 44
Rept. Given: 18
Rept. Rcvd 25 Times in 14 Posts
Thanks Given: 11
Thanks Rcvd at 61 Times in 20 Posts
n00b Reputation: 26
Quote:
Originally Posted by evlncrn8 View Post
.ooa section is just origin, no denuvo implied and are you just assuming .net entrypoint cos of the ff 25 jmp to activation.dll (its not .net at all)
Thats because I haven't analyzed that many newer EA targets - however, my research still stands and is accurate except for that last variation which may or may not be in combination of Denuvo protected games. However, the 0xFF25 EP, is standard EP for almost all .NET compiled assemblies - thus, it -may- resemble the .NET PE EP...
As I also said earlier, I don't claim its actually .NET assembly at all
Reply With Quote
The Following User Says Thank You to n00b For This Useful Post:
tonyweb (12-17-2016)
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On



All times are GMT +8. The time now is 02:23.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )