Flagmax
June 22nd, 2004, 19:41
Hi, I got a program here that trying to unpack. I got a good dump now and program runs. But there is one problem. When I load the dump in Ollydbg, I get a message with one OK button. It says, "This program has been protected by Unregistered Evaluation version of Armadillo..." This shows up before I get to OEP. So I think it happens while Olly loads DLLs. The Armadillo was 3.0a - 3.6, I believe its Dead in my Dump because IAT is not affected anymore and I can easily redump my dump and ImpRec finds the table by itself and disassembly of the dump is good.
I dont know how to break on anything while OLLY loads the EXE. Could it be I messed while manually rebuild IAT table?
When I press Pause in Olly when Msg pops up, it says I am inside IMAGEHLP.DLL and EIP is at 7FFE0304 C3 RETN
Please any info would be great.
Thank you.
EDIT: I was playing with Pause and landed here:
7FFE030F 8BD4 MOV EDX,ESP
7FFE0311 0F05 SYSCALL --------- I believe this brings up the MSG, I can't trace it this Syscall
7FFE0313 C3 RETN
I dont know how to break on anything while OLLY loads the EXE. Could it be I messed while manually rebuild IAT table?
When I press Pause in Olly when Msg pops up, it says I am inside IMAGEHLP.DLL and EIP is at 7FFE0304 C3 RETN
Please any info would be great.
Thank you.
EDIT: I was playing with Pause and landed here:
7FFE030F 8BD4 MOV EDX,ESP
7FFE0311 0F05 SYSCALL --------- I believe this brings up the MSG, I can't trace it this Syscall
7FFE0313 C3 RETN