I detach using Ollydbg plugin.
Attach in another Ollydbg instance.
I create bp on CreateThread
F8....F7 on RETN 18
and instead of ending up to POP EDI,POP ESI....etc...(Address 00A294c4)
i end up on MOV EAX,1 ; TEST EAX,EAX (Address 0043316C).
Please advise - what am i doing wrong
I have unpacked successfully the CrackMe Armadillo 4.30a Simple Protection
So long since i had arma protected exe loaded in my olly
Well i successfuly reach oep using classical technique.
Assuming you detached parent process and attached to child correctly everything should go fine (well i did that manually, so maybe there's some flaw in plugin you've used).
Another problem can be that maybe you close olly with parent process... it should be running at least till you reach oep.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum