Hi!

I've a strange problem with Shut Down Now 4.12 packed with neolite, after decompressing it i can't use the exe coz is withouy IAT !!
i unpack the exe simply with a bpx getprocaddres then after some f8 i find a jmp eax that seems the correct jump to exe entrypoint. What is my error ??


P.s. sorry for my really poor english

Bye

I did it this way:

-Unpack manually or with procdump.
-trace till 507ea8 and go in this call.
-Trace till 470564 ( jz 4705b3 ) and change the jz to a jump . ( some call's made here to kernel seterrormode)

After this it runs and you can disassemble.

Greetz.......SpeKKeL!..........