|
I've noticed that the first byte of the OEP is replaced with CC when dumping with LordPE.
This is not the case when dumping with OllyDump.
A lot of other first bytes in different sub-routines are replaced with CC, byte 55 at offset 68867 for example.
Found a new IAT starting at: 00B4B580 7C81E4BD kernel32.CreateEventA
It's very much corrupted by Arma.
Last edited by SvensK; 11-17-2005 at 16:30.
|