|
@omidgl: "and I ALREADY tried the option in OLLY to break on new module load which did not work"
@Wackyass: I'm still not clear what you are trying to do. You are saying that your dll is multilevel packed and you unpacked neolite part? Becouse... if so, i think that you done a very hard work. When you load dll, try finding OEP. When you get to OEP, dump it and retrieve IAT. Thats when surely both Neolite and custom layer are unpacked becouse dll got to DllMain().
|