Ihad experienced your case.
In my case, I remaked new IAT.
First check the code.
00A7EA9E FF15 3461A800 CALL DWORD PTR DS:[A86134]
A86134 is virtual table of armadillo.
Set hardware breakpoint at 00A7EA9E+2. //00A7EAA
and trace..
3461A800<--- Armadillo patched code (Original code? I don't know..)
so You can find like this
Mov CS:[EAX],ECX
jmp yyyyyy // It will patch all code that access IAT.
KK: //end address of routine
EAX is 00A7EAA, & ECX is 00A86134
if you know ollyscript, you can make some script.
bp xxxxxx
bp kk
l_start:
esto
log eax
log ecx
cmp eip,kk
jne l_start
ret
then you will get like this log msg
XXXXXXXX Breakpoint at XXXXXXXX
eax = 00402C02
mem0 = 77E61BEA | kernel32.Sleep
and You have to make your own IAT maually or not.
(Some Address pointed Virtual table, you can trace and repair!!)
Sorry My english is so poor..
|