|
You've right. The first jump after decryption is done is 0063C55B? I checked now the jump to OEP, and it's decrypted well. Then ferrari should use that address instead of 0063C4B2, and push to 0063C467 instead of 0063C4CB.
regards
__________________
thedutchjewel.freehostia.com
|