Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 11-12-2005, 11:14
Asus Asus is offline
VIP
 
Join Date: Feb 2005
Posts: 594
Rept. Given: 122
Rept. Rcvd 27 Times in 13 Posts
Thanks Given: 147
Thanks Rcvd at 94 Times in 35 Posts
Asus Reputation: 28
PECompact unpack

Hi,

We have an application was packed with PECompact 2.x, I also used QuickUnpack 0.7 to unpack that file and target has been successfully unpacked. When I test unpacked, I got a box with msg is The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.

What did I wrong? Any suggestions?
Reply With Quote
  #2  
Old 11-12-2005, 13:47
James
 
Posts: n/a
Manual unpack it in OLLYDBG. Please post your target info if you don't mind.
Quote:
http://www.tuts4you.com/tutorials/Unpacking/PeCompact%202.xx%20(Unpacking%20&%20Inline%20Patching)/PECompact2.xx-Finding-The-OEP-%26-Inline-Patching.htm
Reply With Quote
  #3  
Old 11-12-2005, 15:31
winndy winndy is offline
VIP
 
Join Date: Sep 2005
Posts: 236
Rept. Given: 104
Rept. Rcvd 26 Times in 12 Posts
Thanks Given: 27
Thanks Rcvd at 16 Times in 13 Posts
winndy Reputation: 26
Quote:
Originally Posted by James
Manual unpack it in OLLYDBG. Please post your target info if you don't mind.
But we cannot vist www.tuts4you.com.
Same with the ARTeam homepage:
hxxp://cracking.accessroot.com/.

But We can vist ARTeam forum:
http://intechhosting.com/~access/forums/index.php?act=idx


It 's the problem dealing with domain?

Regards
Reply With Quote
  #4  
Old 11-12-2005, 17:00
James
 
Posts: n/a
Search for a working proxy...or visit here for PECompact 2.x Analysis & PECompact 2.xx OEP finder (OllyScript).
Quote:
http://www.openrce.org/reference_library/packer_database_view/12
Reply With Quote
  #5  
Old 11-12-2005, 18:10
Peter[Pan]
 
Posts: n/a
Also Check the first section's attributes, they need to be E* insted of 6* which sometimes happens, also check that if the app has a tls table, that it isnt pointing to invalid entires etc, i found this when unpacking some apps from pgware which are pecompact, most of the time the entire tls table can be erased.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 19:00.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )