Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #6  
Old 09-15-2006, 23:24
Jupiter's Avatar
Jupiter Jupiter is offline
Lo*eXeTools*rd
 
Join Date: Jan 2005
Location: Moscow, Russia
Posts: 237
Rept. Given: 43
Rept. Rcvd 62 Times in 37 Posts
Thanks Given: 39
Thanks Rcvd at 192 Times in 58 Posts
Jupiter Reputation: 62
Post ASProtect Verion Detection

Q: how to detect exact ASProtect version?
A: extract TASP object and analyze it.

Q: What is TASP object?
A: TASP object - it's ASProtect DLL used in protected application to perform all protection tasks (e.g. license keys managment). You can extract it from ASProtect.exe (ASProtect itself) resources (RCData -> TASP).

When ASProtect protects an executable, it attaches TASP to protected exe. TASP is packed by aPLib and ASPack, PE structure replaced by own (much easy).

Q: How to extract TASP from protected application?
A: Method 1: Execute protected app under debugger, wait until TASP is unpacked by ASPr stub and dump TASP to disk, place correct PE header (read tutorials about it - there are good old articles for v1.2x by crUsAdEr).
Method 2: Find compressed TASP in .aspr section, decompress and reconstruct it.
Method 3: Use tool for automatic TASP extraction like asdd tool by seeQ or VerA plugin for PEiD/DiE by PE_Kill
So, when you'll get unpacked TASP (ASProtect.dll), you can analyze it with any crypto ananlyzer (for ex. KANAL).

Attached:
VerA 0.15 (PEiD Plugin)
ASProtect v2.3 06.26 ASProtect.dll [TASP] (ready to ananlyze)
ASProtect v2.3 06.26 TASP (from resources, packed)
Attached Files
File Type: rar VerA_015.rar (46.3 KB, 92 views)
File Type: rar ASProtect_23_0626.rar (118.3 KB, 51 views)
File Type: rar TASP_23_0626.rar (133.1 KB, 58 views)
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
FLIRT Signature File Database Kurapica General Discussion 1 03-07-2022 11:08
unpacked file bart General Discussion 2 10-13-2005 17:11
Signature and IDS file of VC++ 7.1 TQN General Discussion 2 07-12-2004 16:49


All times are GMT +8. The time now is 16:46.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )