![]() |
|
#3
|
||||
|
||||
|
maybe you are wrong? i see really no difference and came to the following:
OEP: 4EB139 Stolen bytes: 004EB139 >/$ 55 PUSH EBP 004EB13A |. 8BEC MOV EBP,ESP 004EB13C |. 83EC 14 SUB ESP,14 004EB13F |. 8945 EC MOV DWORD PTR SS:[EBP-14],EAX 004EB142 |. 51 PUSH ECX 004EB143 |. B8 C8AB4E00 MOV EAX,dumped_.004EABC8 IAT is attached. The program works fully registered then (Registered to tA, don't ask why). Edit: i was wrong, it only works registered with filename "dumped_.exe" Last edited by MaRKuS-DJM; 01-17-2004 at 19:25. |
|
|