|
Which protection was it? As any app that uses CALL to jump into MFC is guaranteed to have a valid return address as it's pushed onto the stack by the hardware. What you are most likely seeing is that the app itself is doing the PUSH and then JMPing into MFC. Maybe it pushes the address of some protection function onto the stack, and once the protection is removed, the result is zero, hence the crash?
|