![]() |
|
#6
|
||||
|
||||
|
Q: how to detect exact ASProtect version?
A: extract TASP object and analyze it. Q: What is TASP object? A: TASP object - it's ASProtect DLL used in protected application to perform all protection tasks (e.g. license keys managment). You can extract it from ASProtect.exe (ASProtect itself) resources (RCData -> TASP). When ASProtect protects an executable, it attaches TASP to protected exe. TASP is packed by aPLib and ASPack, PE structure replaced by own (much easy). Q: How to extract TASP from protected application? A: Method 1: Execute protected app under debugger, wait until TASP is unpacked by ASPr stub and dump TASP to disk, place correct PE header (read tutorials about it - there are good old articles for v1.2x by crUsAdEr). Method 2: Find compressed TASP in .aspr section, decompress and reconstruct it. Method 3: Use tool for automatic TASP extraction like asdd tool by seeQ or VerA plugin for PEiD/DiE by PE_Kill So, when you'll get unpacked TASP (ASProtect.dll), you can analyze it with any crypto ananlyzer (for ex. KANAL). Attached: VerA 0.15 (PEiD Plugin) ASProtect v2.3 06.26 ASProtect.dll [TASP] (ready to ananlyze) ASProtect v2.3 06.26 TASP (from resources, packed) |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| FLIRT Signature File Database | Kurapica | General Discussion | 1 | 03-07-2022 11:08 |
| unpacked file | bart | General Discussion | 2 | 10-13-2005 17:11 |
| Signature and IDS file of VC++ 7.1 | TQN | General Discussion | 2 | 07-12-2004 16:49 |