View Single Post
  #4  
Old 01-11-2005, 20:12
MarkusO
 
Posts: n/a
@hajir:
I think "Kerlingen" knows about what you write since he says that he has patched the imports to point directly to the API.
As far as I understand him, he has this kind of code:
Code:
(...)
call     some_label     ; E8 call, not FF15 call
(...)
some_label:
jmp     dllname!exportname     ; "E9" relative jump
So his problem is that normally there is a call or jump to an address of the import table but here it isn't and he doesn't find the IAT in merory or there is even no IAT, so he has no table of entries like you called it.

@kerlingen:
Have you tried to find code like this
Code:
mov     esi, [offset iat+somevalue]
call    esi

;or

jmp     dword ptr [xxxxxxxx]     ; FF25 jump
If your code is written in high-level language (which I think nearly all games are) you should find my code somewhere.
Reply With Quote