|
#16
|
||||
|
||||
|
and really, you don't need to unpack a trainer, just breakpoint on writeprocessmemory / readprocessmemory in most cases gives you what you need, unless the trainer injects a dll, in which case usually virtualprotect gets you to the area (cos it has to change it to writable)... so all a packer gains in essence (at least to me) is a size change and very little else
__________________
bleh DO NOT PM me with questions, leave that in the forums...ESPECIALLY if i dont know you... |
| Sponsored Links |
|
#17
|
|||
|
|||
|
Yeah, you can BP the WPM/RPM etc export rather than the import (which may well be unavailable due to the destroyed IAT), absolutely.
Stating the obvious/pointless comment. It's already been stated. You seriously didn't think you was actually telling me something new did you?! :P Don't like packers, then don't use them :/ Last edited by [Psych]; 24-05-2010 at 11:06. |
|
#18
|
||||
|
||||
|
One more thing pro any kind of compression: the ability to check for damages in the file. (Although the original question was not about this problem/solution...)
I really hate it when - thinking of computer-illiterate users who are hardly able to do more than click on buttons and icons - web pages show you for download naked EXE's, especially large ones. You download them, run them and will get mysterious error messages or seemingly unrelated problems if the file was damaged during download (or upload?!) and it doesn't explicitly check its own integrity. Pack it with an EXE compressor or archive it with ZIP, RAR etc. and you'll find out whether it's damaged or not.
__________________
Joe Forster/STA For more information, see the FileForums forum rules and the PC Games forum FAQ! Don't contact me via E-mail or PM to ask for help with anything other than patches (or software in general) done by me, otherwise your request may be deleted without any reply! Homepage: http://sta.c64.org, E-mail: [email protected]; for attachments, send compressed (ZIP or RAR) files only, otherwise your E-mail will bounce back! |
|
#19
|
|||
|
|||
|
I never had problems with muping PECompact, but an oep dump with fixed iat of hax0rs latest trainers gives me a "Stream read error" message.
Patching that msg away dont help, i get an empty grey window then. Copying the overlay from original file and add it to the dump dont help, too. Whats so special about muping hax0rs trainers? |
|
#20
|
|||
|
|||
|
It's something to do with the Cheat Engine feature on which they are based. It does a similar thing when you unpacked a standard UPX'ed CE trainer. But personally i'm not interested in unpacking, or in any other way, messing with other people's trainers. It never seems to end well whatever the intentions.
|
|
#21
|
|||
|
|||
|
I never saw an upxed CE trainer, you know an example?
I just want to improve my MUPing skills. |
|
#22
|
|||
|
|||
|
Attached.
|
![]() |
|
|