SVKP 1.3x unpacking

[britedream]

I did check the stolen for the last version; 2.16b, and the correct stolen are:

004F9B9C 55 PUSH EBP
004F9B9D 8BEC MOV EBP,ESP
004F9B9F 83C4 F0 ADD ESP,-10
004F9BA2 53 PUSH EBX
004F9BA3 B8 64974F00 MOV EAX,Formik.004F9764

the two versions are right after each other , so I assume there is no difference between the two as far as the stolen is concerned.

[hosiminh]

Thanks you both for replying.

I saw at the fake oep (004F9BA8 CALL Formik.00407320) (just where stolen bytes ends) that EAX == 004F9764
(and in stack window: 0012FFC4 7C816D4F RETURN to kernel32.7C816D4F , at 7C816D4F is EAX PUSH-ed into stack ) but i was unsure if i have the right one.

[britedream]

the last push in the stack is the ebx register = 7ffdf000

regards.