Hello everyone.
I have a question on finding stolen bytes in ASProtect 1.22 - 1.23 Beta 21.
I use the usual technique to get to the program code (in Olly: find last exception, bp on ret, on break there set memory breakpoint on code, run). I get to the code here:
Code:
0051C76D . C3 RETN
0051C76E ? 51 PUSH ECX
0051C76F . 0000 ADD BYTE PTR DS:[EAX],AL
0051C771 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C773 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C775 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C777 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C779 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C77B . 0000 ADD BYTE PTR DS:[EAX],AL
0051C77D . 0000 ADD BYTE PTR DS:[EAX],AL
0051C77F . 0000 ADD BYTE PTR DS:[EAX],AL
0051C781 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C783 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C785 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C787 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C789 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C78B . 0000 ADD BYTE PTR DS:[EAX],AL
0051C78D . 0000 ADD BYTE PTR DS:[EAX],AL
0051C78F . 0000 ADD BYTE PTR DS:[EAX],AL
0051C791 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C793 . 0000 ADD BYTE PTR DS:[EAX],AL
0051C795 . E8 02A5EEFF CALL x.00406C9C <---- STOP HERE
0051C79A ? 8B3D 84285200 MOV EDI,DWORD PTR DS:[522884]
Thing is, if I do a "trace into" after setting the memory breakpoint it never breaks! So how can I track down the stolen bytes? Is there any other way, or am i doing something wrong? BTW, the app is a screensaver...
Someone please help! :-)