View Single Post
  #6  
Old 11-21-2004, 06:20
Michel Michel is offline
Friend
 
Join Date: Sep 2004
Location: France
Posts: 66
Rept. Given: 2
Rept. Rcvd 6 Times in 1 Post
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Michel Reputation: 6
Hello,
Sorry if this is a little out of topic, but I had a very similar problem (solved) with progs protected by PcGuard.
It is important to trace to the point where the sections are decrypted by some param extracted from the Name/Serial/progID..., even if they are fake.
In facts, while decryption procedure occures, a CRC on the decrypted datas is computed at the same time. After the whole section is done, the CRC is compared to some reference, wich must be hard-coded, in order to be sure all was done in the right way. This check generates the second message.
Now this check is very usefull because you can assemble in Olly a small loop witch increments the param and checks the CRC result (of course, the decryption routine must be a little modified in order to leave the section at his original stade at every loop).
So this very fast brute-force routine will gives you the right param in few minutes (maybe hours).
After that, restart all, bypass the first Name/Serial check, put the right param just founded, and now you can trace to the OEP
I don't know if this is usefull for Armadillo, let me know... good work !

Last edited by Michel; 11-21-2004 at 06:24.
Reply With Quote