Quote:
Originally posted by AYB
Is it not possible to simply replace the INT3 with a JMP to the rest of the code? In order to debug the unpacked executable that is.
|
You could, but first you'd have to do some cleaning up of the stack.
By the way, the debugger detection routine is in the unpacker/loader section of the executable. I've yet to succeed in unpacking it.