|
ASProtect SKE unpacking
Hi Everyone,
I have been trying to unpack a few programs protected with ASProtect SKE and having issues in resolving the numerous calls to the VM.
The SKE versions range from version 2.2 Build 4.25 to 2.56 Build 3.17 according to ASPriNF v1.6
The programs neither have Stolen Bytes nor IAT redirection, hence
there are no problems reaching the corresponding OEPs either manually or with scripts.
Unfortunately I am not able to rebuild the Calls to the VM with the Script RebuildVM.osc from PE_Kill. The script always terminates with the Error message ��[Error!] Init failed!". This message can be triggered at 9 locations before and 1 after the prompt to "Enter new base of this code". As I am getting the error before the Prompt I had to debug the script to find where exactly the error is first triggered. Finally I was able to locate it to the routine @find_the_error111
Does it mean that all SKE protected programs must have this Error 111 and the script terminates because it is unable to locate it?
If I comment this routine out, then the next init error is triggered @find eip,#2C027212743D#
Tip hints for resolving this error or a link to alternative scripts for rebuilding the VM is highly appreciated.
And just by the way the unpacking scripts from Volz are not working on these targets.
All the affected programs throw the CRC error when the Volz��s scripts are used.
Thanks and best regards,
TempoMat
PS: I am RCEing on a VirtualPC with WinXP Pro SP3.
|