Ricardo Narvaja
November 24th, 2003, 05:26
I see various new programs, this use a loader EXE of 32 bits and CreateProcess of 16 bits for work only with virtual machine of NT.
If you can run this program of 16 bits in a DOS BOX don't RUN and don't work with turbo debugger and any DOS DEBUGGER.
If you dissasemble de 16 bits file with IDA, you look very easy the part to patch, but you need some values provided for a debugger in this point.
How i can work with this type of files, if i enter in softice and type
ADDR ntvdm.exe, the point for work is not clear for me, how i see in IDA.
Any work with a file of this type?
Ricardo
If you can run this program of 16 bits in a DOS BOX don't RUN and don't work with turbo debugger and any DOS DEBUGGER.
If you dissasemble de 16 bits file with IDA, you look very easy the part to patch, but you need some values provided for a debugger in this point.
How i can work with this type of files, if i enter in softice and type
ADDR ntvdm.exe, the point for work is not clear for me, how i see in IDA.
Any work with a file of this type?
Ricardo