                        ActiveMARK V6.x generic dumping tool

IMPORTANT:
1. Designed exclusively for ActiveMARK v6.X.
2. Make sure you use with Administrative priviliges.
3. May only work with WinXP?
4. Tool does not have to reside in the application directory / path.

Usage:
Open ActiveMARK v6.X specific target (executable).

Program will dump the target via CreateProcess API(debug only this process) and attempt to to do the following:

1. Find the 2nd layer EP by hooking VirtualProtect API and finding last PE code section before main Level I EP.
2. Fix Virtual Memory address pointer to PE .data address
3. Modify original EP instruction(s) to PUSH new Level 2 EP and RETN.
4. Create a new dump file of the original target process.
5. Fix PE header Section for dumped process.
6. Append encrypted data to EOF of newly dumped process.

That's it...