SoftSentry v2.0

I know fairly well the 3.0 version (a stupid protection), but I guess that same concepts apply to the 2.0 one ( even more stupid; I cracked only a program protected with it).

SoftSentry may work in two modes: as an external protection (i.e. a DLL that exports functions called by the protected program), or as a wrapper (appending code and data sections to main program, and varying the PE header as needed).

As you do not mention any DLL and talk about VisualBasic, I think that 'your' mode is the latter; probably, your target was written in VB; this is the reason why you've found that 'medley'.

The wrapper of the 3.0 version crypted the 80 starting bytes in the code section; not so, AFAIK, the 2.0 version. You need only to find the program OEP; by simply changing the corresponding PE header value, the main program will work flawlessly. Alternatively, you can find the unlock function and crack it.

The various function exported are only a banal trick; this is quoted from SSentry help:

"To enhance security by making it more difficult to determine the purpose of the softSENTRY DLL when monitoring the calls to it, softSENTRY provides several alternative function calls that can be use in place of the default softSENTRY() call."

All functions execute a JUMP to the softSENTRY() one.

IMHO, SoftSentry was a well written program, a very nice application, a wonderful example of programming techniques, but n appalling protection...

Hope it helps