IL-2 Sturmovik: 1946

[TippeX]

must be very simple
u can unpack it in olly, trace from the start, scroll down a little and you'll see 2 calls to do the imports then at the end an add esp, some value
then jmp realeip
dump from there, rebuild imports.. sorted
/me wonders why the new (nothing like the real one) fairlight packed it..

[cdkiller]

/me wonders why the new (nothing like the real one) fairlight packed it..

prolly due the reason that exe is >30 MB unpacked. same approach as rld, they didn´t fully rebuild the exe.
if they want to "hide" anything they wouldn´t have used upx

[chron]

Originally Posted by TippeX

must be very simple
u can unpack it in olly, trace from the start, scroll down a little and you'll see 2 calls to do the imports then at the end an add esp, some value
then jmp realeip
dump from there, rebuild imports.. sorted
/me wonders why the new (nothing like the real one) fairlight packed it..

I never tried working with a debugger. I only used Olly vor Disasm if Win32dasm failed. But I think I'll go further in the next time to level up.