|
|
|
|
#1
11-01-2017, 13:33
|
|||
|
|||
Thankyou Mr. Smiling Wolf...
Lords are blessing me like never before. First Mr. Exodia And now Mr. Smiling wolf...Its Xmas with lots and lots of presents... loving it
 Thank you Mr. Smiling Wolf for the help as always.. I will try that splices redirection. Can't believe you took some time to do that brute forcing for me, you are so kind as always. Oops, sorry guys I accidently break a rule, hope you guys will let this one pass. It won't happen again. I promise Mr.CyberCoder, thats really interesting to know. I will definitly give it a try. I am absolutely speechless.. I mean the Lord himself did the brute forcing for me and Mr.Exodia almost cracked it for me, how awesome is that for a Xmas Last edited by Benten; 11-01-2017 at 13:37. Reason: Respects to Mr.Exodia and Mr. Smiling Wolf.. Regards to ExeTools Family |
|
#2
11-02-2017, 15:20
|
|||
|
|||
|
I was just fooling around the x86 code and struck upon this one. Thought you guys should see it.
There has been absolutely no luck building clean IAT till now, but I am trying. And no luck using tools either, I've hit my bottom and started using tools temporarily, that is.  The point is, I believe nop-ing the mov (below) inside the call that follows Push 0x100 unpacks the thing, correct me if wrong, and the errors are still there. If it were splices then that error shouldn't be there if I chose to run, right? Code:
mov byte ptr ds:[eax], dl Regards, Ben Last edited by Benten; 11-02-2017 at 15:21. Reason: Respects to Mr.Exodia, Mr.Smiling Wolf, FFF & Regards to Abhi & Exetools family |
 |
| Tags |
| armadillo, armadillo unpacking, import elimination, tutorial request |
| Thread Tools | |
| Display Modes | |
|
|
Hybrid Mode
