|
|
#4
10-22-2003, 10:50
|
|||
|
|||
|
Thanks Ohpen...heres one packed with dillo 2.5x - 2.6x
_http://etcai.com/digital4.exe I tried doing it myself with Ricardo's tut BUT..instead of dillo unpacking code blocks of 1,000 byte chunks when i break on write process memory i see that it only writes 2 bytes at a time..ALSO in Ricardo's tut if you break on WaitForDebugEvent you,ll get the address of dillo's REPORT so that when you break on writeprocessmemory after you get to see the OEP..this worked on another target but on this one you dont get to see the OEP...The OEP was found another way but just shows you that this program does things slightly differently?? Good luck and thanks again paul333 Last edited by bunion; 10-22-2003 at 10:53. |
|
|
Threaded Mode