![]() |
|
#28
|
|||
|
|||
|
To Wurestgote
if you are wondering about registration, at address 578685 mov edx, dword ptr ds:[620484],the value 620484 is point to an address make sure this addres point to anything except zeroes. (this is what I understood from the post) how to find the first address: this is what i did: 1- view memory, choose the region right after the code region. 2- search for binary 0000000061, you will see the address of the popad go to it,set bp memory on access at the popad,run 3- first stop is only compare , so f9, will stop at the address above (578685). regards. Last edited by britedream; 02-17-2004 at 16:33. |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| one newbie question | SubzEro | General Discussion | 7 | 03-12-2015 06:05 |
| ASPR, ARMA question | sgdt | General Discussion | 3 | 04-09-2006 03:38 |
| ASPR 1.2 question | gabri3l | General Discussion | 42 | 05-01-2004 15:09 |
| a newbie question about CRC32 | abccc | General Discussion | 13 | 04-23-2004 03:13 |
| "newbie" question for crackers ;) | newbie007 | General Discussion | 4 | 10-07-2003 04:46 |