another how to

I just want to find a general way to locate the double-dip of ASPR. There is no /tracex in Win2K. so did you use the tracer of RV? please share your discovery

sometimes I find the double-dip is right after RegQueryValueExA("Key".

...and after that you saw the call address for dip is a reference address stored a lookup table......and so lookup the lookup table in SI and see how many other addresses are around there .......note them down or 'print screen' and maybe bpx them now to check ?

Spl/\j

thx SplAj. I will try it

How about your legs now?

Hi Solomon.

As fox3 pointed out in some other thread, AsProtect stop at 401014 before dipping, so you can use your usual trick of bpx at iret and then set bpm 401014 x, sice should breaks there and u will find the dipping area after a weeny bit of tracing :>

Also, you can use revirgin to note down all dip VA and set breakpoint on them when u break at 401014... that will aid tracing a bit :>...

regards,