How to defeat Password Reminder 1.6 ? (An unknown protector)

today i played with this target.. check if all is OK.
btw, it's marked as SD1.1 at start of 1st section??

original IT restored; OEP bytes restored from 00495C50h;
resource restored by PExplorer; there was 7 crypted code blocks,
wich decrypted on runtime;

..
shit, failed for attach!

at hxxp://www.angelfire.com/indie/zong


EnJoy

[hosiminh]

@newbie_cracker

For Imprec - it looks for file "ImportREC.exe" and for title "Import REConstructor v1.6..."

You can easy change title with Customizer or similar program.


For LordPE - SDpacker absolutely hates this tool . Apply the same steps as for ImpRec

btw. It shows wrong Image_Size of process ( 0x00036000 ). Use any other tools for dumping .



@KaGra

I like your tuts , but what would you do if your target is packed with regged version of packer and you don't have intro Nag to attach ?

well,if I don;t have a registered version in my hands,I cannot make any assumptions.But i'd like to have one...

[Newbie_Cracker]

Thanks hosiminh

My problem solved in patching the process in memory. Greetings to The Boss.

I bypassed LordPE detection and dumped the flle. But PE tools dumped better than lordpe, without any errors. Is there a good dumper except Lordpe and PE Tools?

The remaining problem is OllyDbg detection and Unpacking method.

Regards

[dyn!o]

It depends what you mean. The best dump is always a manual dump. The way of dumping running process simultaneously with its execution (like LordPE, PETools do) is a weak and not "clean" idea. Usually it forces you to keep redundant sections but most of all it makes unpacked executable a lot bigger than original one.

Anyway, it's only my private opinion and you can always work this way. For Delphi executables the best dumper is DeDe (with ability to find OEP).

Regards.

[Newbie_Cracker]

Really thanks KaGra.

You've written very usefull tuts and put in you homepage.
Almost, All of my question is answered.

Best regard.

uploading once again..

this program maybe is interesting for reversing.