![]() |
|
#11
|
|||
|
|||
|
Not to worry mate, it is probably just me, probably hard to teach an old dog new tricks, at least you got through to me how to fix the import table, I just coudn't see the instruction that moved the first item to the iat.
Here is the error message generated by the unpacked .exe: 00410994 /$ 68 30100000 PUSH 1030 ; /Style = MB_OK|MB_ICONEXCLAMATION|MB_SYSTEMMODAL 00410999 |. 68 AC094100 PUSH RegDefra.004109AC ; |Title = "Warning" 0041099E |. 68 B4094100 PUSH RegDefra.004109B4 ; |Text = "File corrupted ! Please run a virus-check, then re-install the application." 004109A3 |. 6A 00 PUSH 0 ; |hOwner = NULL 004109A5 |. E8 D24FFFFF CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA 004109AA \. C3 RETN And references to this command: References in RegDefra: to 00410994 Address Disassembly Comment 00410994 PUSH 1030 (Initial CPU selection) 00412D68 CALL RegDefra.00410994 00413C3E CALL RegDefra.00410994 00414569 CALL RegDefra.00410994 00415DD1 CALL RegDefra.00410994 0041680B CALL RegDefra.00410994 00416AD1 CALL RegDefra.00410994 00416FD0 CALL RegDefra.00410994 004176B6 CALL RegDefra.00410994 004176EA CALL RegDefra.00410994 004181C3 CALL RegDefra.00410994 00418A3B CALL RegDefra.00410994 00418C70 CALL RegDefra.00410994 00418CA6 CALL RegDefra.00410994 00418CDC CALL RegDefra.00410994 00418D0F CALL RegDefra.00410994 00418D42 CALL RegDefra.00410994 Is getting rid of this error message more complicated than just nopping all these calls? |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Help with ASProtect 1.23 RC4 | Perdition | General Discussion | 7 | 06-09-2004 01:48 |
| New Asprotect?? | loman | General Discussion | 7 | 02-04-2004 20:34 |