I have a target packed with ASPR 1.23.

I dumped it, put back stolen bytes, fixed IAT with imprec.

All runs fine under XP, not on 2000. It cant find function 525 from advapi32.dll

Did i miss something?

(feel free to offend me if this has being already talked before, i just couldnt find anything about it.. )

Thanks..

RF1911

Does function 525 have a name or is it being imported by ordinal?

I would first try to remove the entry for the import from the IAT manually (not too hard).



-nt20

Hi

If it is telling you this in a messagebox then the name is different in 2000.

Like RestoreLastError (XP) & SetLastError (ME)

/hobferret

It's imported as ordinal..

How can u handle those situation (XP/ME/2000)

Thanks!

In windows XP 's advapi32.dll (SP0) function with ordinal number 525 is SaferComputeTokenFromLevel