Thread: Visual Protect
View Single Post
  #4  
Old 09-10-2004, 11:22
bukkake's Avatar
bukkake bukkake is offline
VIP
 
Join Date: Aug 2004
Location: /usr/home
Posts: 127
Rept. Given: 2
Rept. Rcvd 14 Times in 3 Posts
Thanks Given: 0
Thanks Rcvd at 3 Times in 2 Posts
bukkake Reputation: 14
Must be your lucky day, the tut I have is for an old version of StromPredator, but still works for the new version, I just tried it.
Since you can't download, I'll try to explain here.
Run Olly, and set it like this (Options->Debugging options):
In SFX: "Trace entry real blockwise", and enable "Pass exceptions to SFX extractor"

Load the target, press F9, you get that "Visual Protect trial" box, click "try" button, then let OllyDbg trace it, it will land in the EOP (0047CAE0), then dump the target. Start ImportRec, enter the EOP (7CAE0), then press "Get import", then "show invalid", then click "Autotrace", it will take a few seconds, so just be patient. Delete the thunk at RVA 00083818, double click thunk RVA 003B00E0, choose module "kernel32.dll", then scroll down to "Kernel32.GetProcAdress", should be "ord:0191", select it then click ok, then click "Fix dump", and choose the file you dumped with OllyDbg, target unpacked and no more nag window
Reply With Quote