|
thats not true for armadillo.... peid says armadillo 3.78 if it uses the layer from the adata section as ep (ep is a pushad then)
but if a author uses minimum protection it will have a push ebp at the ep and so peid will identify it as 1.x - 2.x also if its a newer version...
|