Ok, finally I make a loader work under
both win2k and win98 to patch a ASProtect 1.2x protected app.
But I have a big question, when I use
WriteProcessMemory too early, it says
Protect Error .15 etc. But I got to work
aorund this problem.

Could anyone tell me something, how is such
action being detected by ASProtect? Any
hint about it?

I try to search forum, but you can search
only msg within 30 days, It really not
enough.

I'd say some sort of CRC mechanism is at work...I've seen such loops in ASPR layers, so just be sure to patch right before return to OEP.

madmax

Yes, I know that CRC check. I have found
out the part of CRC check in 1.2x.
But about the anti loader mechanism I really
want to know something about it.