Log in

View Full Version : trouble finding CALL ECX and hooking IAT in armadillo packed


tim mactroy
January 3rd, 2006, 03:47
I will put bp o CreateThread and I will return to exe code but I get PUSH ECX instead Call ECX .
The other problem is after getting into oep by searchin ff25 in bynary I cant find the jmps to imports and I get stuck with some garbage code
Whats the solutions mates ?

MCTroy
good luck

arjuns
January 3rd, 2006, 07:04
Accroding to my practice over Armadillo, there are two return after breaking on CreateThread, finally you get Call EDI or Call ECX that leads you to the OEP of that application.Put a Bp on that Call EDI of Call ECX there you get what you want.
arjuns