![princess maker 4 english rom princess maker 4 english rom](https://hinoyabu.files.wordpress.com/2010/08/top_hvide.png)
These guys not only hidded the call in a temporary and invisible dll, but also gave the function call a deceiving name.
![princess maker 4 english rom princess maker 4 english rom](https://hinoyabu.files.wordpress.com/2009/07/pm4_1.jpg)
I was nuts about this weird address 0x12345678 and it took me a while before I finally saw that this is NOT an ordinal number (in that case it should be less or equal to 0x0000FFFF) and in reality the first letter is not a zero but the letter "O" instead. Whoever wrote that protection schema should be informed that he caused me a big headache. I'd be curious to see what happens in huh's working computer to check if it is possible to emulate this virtuous behavior: could you send me some logs of the very first frw seconds of the program life? It seems that the program wants to be sure to load genuive versions of some important call for intrusion detection (ReadProcessMemory, WriteProcessMemory, VirtualProtect: DxWnd uses them!), then loads some sort of test call with an impossible ordinal number (0x12345678 !!! I can't believe there is a real dll with 0x12345678 = 305419896 functions inside) from within a hidden and temporary dll ("C:\Users\user\AppData\Local\Temp\~e5.0001.dir.0000\~df394b.tmp") and makes three attempts before deciding that the game must be terminated.
#PRINCESS MAKER 4 ENGLISH ROM .DLL#
dll version = 0 Registered DLL FileName = KERNE元2. dll version = 0 HookDirect3D : module = 0圆6700000 name = d3dim700. tmp flags = 0 LoadLibraryA : hooking lib = "C:\Users\user\AppData\Local\Temp\~e5.0001.dir.0000\~df394b.tmp" handle = 0圆6700000 HookDirectDraw version = 0 HookDirect3D : module = 0圆6700000 version = 0 HookDirect3D : module = 0圆6700000 version = 0 HookDirect3D11 : module = 0圆6700000 version = 0 HookDirect3D : module = 0圆6700000 name = d3dim. dll LoadLibraryA : ret = 0圆6700000 GetProcAddress : hModule = 0圆6700000 idx = 57 proc = Ox12345678 GetProcAddress : module = 0圆6700000 proc = Ox12345678 ret = 0圆67533b7 FreeLibrary : hModule = 0圆6700000 FreeLibrary : ret = 0x1 FreeLibrary : hModule = 0x3470000 FreeLibrary : ret = 0x1 LoadLibraryA : file = C :\ Users \ user \ AppData \ Local \ Temp \~ e5. dll LoadLibraryA : ret = 0圆6700000 GetProcAddress : hModule = 0圆6700000 idx = 57 proc = Ox12345678 GetProcAddress : module = 0圆6700000 proc = Ox12345678 ret = 0圆67533b7 FreeLibrary : hModule = 0圆6700000 FreeLibrary : ret = 0x1 LoadLibraryA : file = C :\ Users \ user \ AppData \ Local \ Temp \~ e5. dll hdl = 0x76540000 LoadLibraryA : ret = 0x76540000 GetProcAddress : hModule = 0x76540000 idx = 0 proc = ReadProcessMemory GetProcAddress : ret = 0x76575740 GetProcAddress : hModule = 0x76540000 idx = 0 proc = WriteProcessMemory GetProcAddress : ret = 0x76576520 GetProcAddress : hModule = 0x76540000 idx = 0 proc = VirtualProtect GetProcAddress : ret = 0x76557c70 LoadLibraryA : file = C :\ Users \ user \ AppData \ Local \ Temp \~ e5.
![princess maker 4 english rom princess maker 4 english rom](https://cdn.cloudflare.steamstatic.com/steam/apps/724250/capsule_616x353.jpg)
dll LoadLibraryA : push idx = 0 library = Kernel32. dll flags = 0 Registered DLL FileName = Kernel32.