Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #2  
Old 12-12-2005, 16:47
hosiminh hosiminh is offline
Friend
 
Join Date: Aug 2004
Posts: 202
Rept. Given: 2
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 0
Thanks Rcvd at 4 Times in 4 Posts
hosiminh Reputation: 1
target version 3.2 sr6
MD5= 063220da662761f8ab27c92d57f68a49 ; HFFR.exe


last exception:
03A12CF2 31C0 XOR EAX,EAX
03A12CF4 64:FF30 PUSH DWORD PTR FS:[EAX]
03A12CF7 64:8920 MOV DWORD PTR FS:[EAX],ESP
03A12CFA 3100 XOR DWORD PTR DS:[EAX],EAX

Dunno what you have been doing , but i put memory bp on 2nd section , passed last exception to program i landed here:

oep:
00432236 55 PUSH EBP
00432237 8BEC MOV EBP,ESP
00432239 6A FF PUSH -1
0043223B 68 F04A4000 PUSH HFFR.00404AF0
00432240 68 FA214300 PUSH HFFR.004321FA ; JMP to msvcrt._except_handler3
00432245 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0043224B 50 PUSH EAX
0043224C 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
00432253 83EC 68 SUB ESP,68
00432256 53 PUSH EBX
00432257 56 PUSH ESI
00432258 57 PUSH EDI
00432259 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0043225C 33DB XOR EBX,EBX
0043225E 895D FC MOV DWORD PTR SS:[EBP-4],EBX
00432261 6A 02 PUSH 2
00432263 FF15 E8174000 CALL DWORD PTR DS:[4017E8] ; msvcrt.__set_app_type

MS VC target...

anti-dump
004222EA FFD0 CALL EAX //nop it

otherwise you will get funny MsgBox:
"Shame On You"
"Protection not found !"

Last edited by hosiminh; 12-12-2005 at 17:10.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 02:54.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )