Hello. I was reading a great tutorial by Rongchaua on fixing the method RVAs for files protected with CliSecure 4.5, and if you download this package you'll see a program called
CliSecure Fixer.exe.
Link here:
Code:
http://portal.b-at-s.info/request.php?94
If you compare the SampleCrackme Original.exe and the SampleCrackme Original_patch.exe, you'll see the changes of the method RVAs in the method table. I'd like to know how this program accomplished this? If anyone could share with me the formula to calculate the new RVA that would be great.
Thanks.