View Single Post
  #8  
Old 03-24-2004, 10:59
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
for all the startup code that has mov ebp,esp , yes; your hint to the start of the stolen is the first encounter of ebp== esp, which is the second byte of your stolen, so push ebp should be the first.

Last edited by britedream; 03-24-2004 at 11:19.
Reply With Quote