|
Hmm
If you erase IceExt information from the register, and then make sure to make the program jump at the right places, your program should run without problem. To find the "important" checks, use bp CreateFileA after attaching the child process to a running copy of Olly. After several hits, Olly will end up checking to see if Softice is installed. When that happens, exit the CreatefileA routine, and trace down a little bit in the code. There you will find the OpenService check. After that check you will find a couple of jumps that need to be changed during runtime.
Good luck,
hobgoblin
|