|
if the statement which you brought here is the correct one, then I think here are your stolen bytes:
55 PUSH EBP
8BEC MOV EBP,ESP
83C4 F4 ADD ESP,-0C
B8??????? MOV EAX, ????????
The value of ???????? you can get when you are on the fake OEP (005FD99F), just look at your EAX register.
|