Thread: New Asprotect?
View Single Post
  #7  
Old 05-19-2004, 05:34
bollygud
 
Posts: n/a
Quote:
Originally Posted by hobgoblin
Hi guys,
Why don't you guys in a few words explain how you unpacked it and fixed the iat?

regards,
To keep it as few words as possible, I'll simply explain the method by which you can unpack and run this version. If you're not familiar with aspr or the pe file format then the following will not help you.

Get to OEP as usual, break on many exceptions and jump over the last exception and RET which will eventually lead you to EP. Then you can dump, that's the easy part. Then what you must do is dump the ASPR envelope from memory and attach it to your dump. I have seen regular sized apps with big import tables and at the moment I have no way of fixing or creating and iat. Once you've attached your ASPR to your dump you need to fix the import table to point to the proper thunks.

That's the extreme basic way of doing it

There are things you can do to change the ASPR envelope's native address, etc. Plus lots of cleaner ways to rebuild your pe. But that right there is the basic idea.

Also note that this approach will only allow the dump to run on your machine or possibly only the same os. It's definitely not a cross-platform solution with a generic iat/import table. But it works nonetheless.

One other thing to mention. Since this version does not use the native iat to point to system apis or redirected apis it will be quite a task to create an iat and that, really, is the only stumbling block for a more 'pure' solution. The other things such as obfuscated redirected functions are quite a bit tougher with this version, but that can always be resolved by simply attaching the obfuscated code somewhere and redirecting the jump/call to it.

I hope that answers some questions

Last edited by bollygud; 05-19-2004 at 05:39.
Reply With Quote