![]() |
|
|
|
#1
|
||||
|
||||
|
IsDebuggerPresent
77E72740 64A118000000 mov eax, dword ptr fs:[00000018]
77E72746 8B4030 mov eax, dword ptr [eax+30] 77E72749 0FB640002 movzx eax, byte ptr [eax+02] 77E7274D C3 ret In the memory dump window, edit (eax+2] , it's ADD 7FFDF002 and change his value from 1 to 0 ! |
![]() |
|
|