I know a tool named "AIPH" can do it.
You can search this forum or woodmann forum to get it.

hi

can someone explain How can I find the adress of hProcess for this loader?
my proggy ist protect by Asprotec 2.0 :-(

thanks

good tutorial:
http://biw.rult.at/coding/loader.htm


hProcess is part of PROCESS_INFORMATION structure. this structure is filled when you call CreateProcess. just check the tutorial ;)

Sure you can inline patch asprotect
 

in two ways , that I know, one is a perfect but harder than the other one, the second is less perfect, it misses some time but you always can re-click the target, easy, it involves only one comparison that you have to make it jump , which is so obvious that you don't even have to look for it to find it, and a jump to the oep, after that aspr is practically finished.you can patch once you are at the oep or better yet is to patch when the target is about to execute the code you are trying to change.


regards.
BriteDream

could you paste this jump location code?

I think its better to pm such things... because if you post them public the author will have it easy to find his mistake and change it...

i undersand what you mean eggi, but i think there are many who would like to understand this current method for inlining aspr targets, it seems there are only few who can do this, i for one would like to know any information that might be made available...

--
bedrock

thanks

@britedream my problem is to find the OEP :confused: ,if i find i can use diabolo's loader

cu