|
To Wurestgote
if you are wondering about registration, at address 578685 mov edx, dword ptr ds:[620484],the value 620484 is point to an address make sure this addres point to anything except zeroes. (this is what I understood from the post)
how to find the first address:
this is what i did:
1- view memory, choose the region right after the code region.
2- search for binary 0000000061, you will see the address of the popad go to it,set bp memory on access at the popad,run
3- first stop is only compare , so f9, will
stop at the address above (578685).
regards.
Last edited by britedream; 02-17-2004 at 16:33.
|