Informatika és tudomány

gp.gif
  • MerlinW
    #20
    Proper note:
    ~~~~~~~~~~~~

    SKIDROW uses direct calls to API in their crack, for example:

    00402A34: E85565F47B CALL 7C348F8EH
    00402A39: 59 POP ECX
    00402A3A: 6804404000 PUSH 00404004H
    00402A3F: 6800404000 PUSH 00404000H
    00402A44: E875F2F37B CALL 7C341CBEH

    Because modules are sometimes loaded at a different memory base, indirect
    jumps for API calls are required.
    That is why IAT exists.