|
1.) Start Cabal
2.) Bypass Mshield and attach some debugger on running process(CabalMain.exe)
3.) search expression below;
004A82FA 83F0 57 XOR EAX,57 - 4th xor
004A830C 83F0 67 XOR EAX,67 - 3rd xor
004A831E 83F0 65 XOR EAX,65 - 2nd xor
004A832F 35 92000000 XOR EAX,92 - 1st xor
if notting found on expression, just click follow 1 times.
|
