Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 12-18-2004, 06:52
the_beginner the_beginner is offline
Friend
 
Join Date: Feb 2004
Location: Germany
Posts: 85
Rept. Given: 114
Rept. Rcvd 13 Times in 7 Posts
Thanks Given: 97
Thanks Rcvd at 16 Times in 9 Posts
the_beginner Reputation: 13
Inline patch or loader for Asprotec 1,24-1.3????

hi

I got a proggy is packed with Asprotec 1.24-1.3 and I don't know how can I make a loader (because ERROR 45) Protection Error .
Have some one a Idea??

hXXp://www.haenlein-software.de/haenlein-software/index2.php?navigation=dvr-studio-pro&s=2&unav=nav_progs&sprache=german

Many Thanks
Reply With Quote
  #2  
Old 12-18-2004, 10:48
nimda2k3
 
Posts: n/a
Smile

Maybe this will help you.
hxxp://www.exetools.com/forum/showthread.php?t=2300&highlight=AsProtect+Loader+v0.b

Another tool you can try,I think it's great.

Quote:
DzA Patcher v1.3 for Windows 95/98/NT/ME/2000
읕컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴

coded by DzA [TNT] using Tasm 5.0
Greetings to:LightB,Singe!,SiR dREam,Wishmaker,_blade_



Description:
읕컴컴컴컴컴컴컴컴컴

If you were looking for a tool wich can PATCH almost any kind of encrypted/compressed PE file,without using crap
"loaders" or other kind of memory patchers,without needing to spend so much time to do a direct patch in the exe using
compressor/encryptor loader redirectioning methods ,well you were looking for DZA's Patcher.
With this patcher you can even patch files wich were encrypted with multiple layers
Reply With Quote
  #3  
Old 12-18-2004, 18:39
the_beginner the_beginner is offline
Friend
 
Join Date: Feb 2004
Location: Germany
Posts: 85
Rept. Given: 114
Rept. Rcvd 13 Times in 7 Posts
Thanks Given: 97
Thanks Rcvd at 16 Times in 9 Posts
the_beginner Reputation: 13
thanks

bad this still not work :-(, shit because i god many Errors :-(
Reply With Quote
  #4  
Old 12-18-2004, 22:48
diablo2oo2's Avatar
diablo2oo2 diablo2oo2 is offline
Family
 
Join Date: Mar 2004
Posts: 231
Rept. Given: 6
Rept. Rcvd 111 Times in 26 Posts
Thanks Given: 0
Thanks Rcvd at 6 Times in 6 Posts
diablo2oo2 Reputation: 100-199 diablo2oo2 Reputation: 100-199
ABEL Loader Maker can make asprotect loader. it patch when he find the window
of the app.

another little trick i use to make asprotect loaders:
i code a loader which wait till a value is written to memory, after the
crc check

so it look like this in asm

Code:
invoke CreateProcess,addr filename, NULL, NULL, NULL, NULL, NULL,
			      NULL, NULL, ADDR Startup, ADDR processinfo
	.IF eax == NULL
		invoke MessageBox, NULL,SADD ("Can't create process"),ADDR filename, MB_ICONEXCLAMATION
	.ELSE	
		@readagain:
		invoke ReadProcessMemory, processinfo.hProcess,04BB014h,addr ReadByte, 4, NULL
		.if dword ptr[ReadByte]==00401270h	;test value ...is crc check over?
			;now patch....
			invoke WriteProcessMemory, processinfo.hProcess, 0043CFC7h, ADDR NewBytes,SIZEOF NewBytes, NULL
			invoke WriteProcessMemory, processinfo.hProcess, 00490a9ch, ADDR NewBytes2,SIZEOF NewBytes2, NULL
		.else
			jmp @readagain	
		.endif	
	.ENDIF
__________________
Thinking In Bytes
Reply With Quote
  #5  
Old 12-20-2004, 02:11
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
the_beginner:

Small lesson in proper English spelling, simply because your effor makes a word you do not intend.

You keep spelling the English word "got" (erhalten) as "god" which is the English word for Gott. Major difference. I know that in German a "d" at then end of a word can sometimes be pronounced as a "t" but that is a rather important word not to use by mistake. Verstehen?

Regards,
__________________
JMI
Reply With Quote
  #6  
Old 12-20-2004, 03:27
diablo2oo2's Avatar
diablo2oo2 diablo2oo2 is offline
Family
 
Join Date: Mar 2004
Posts: 231
Rept. Given: 6
Rept. Rcvd 111 Times in 26 Posts
Thanks Given: 0
Thanks Rcvd at 6 Times in 6 Posts
diablo2oo2 Reputation: 100-199 diablo2oo2 Reputation: 100-199
here is an example loader code for an asprotect code:
Code:
http://diablo2oo2.di.funpic.de/stuff/photoclean.2.10-aspr.loader.sourcecode.rar
you can find the target app here
Code:
http://www.trulyphotomagic.com
PS: My next dUP version will support this MemCheck Method. so you can create
loaders for many asprotect apps.

Code:
http://diablo2oo2.di.funpic.de/stuff/dup.memcheck.loaders.jpg
__________________
Thinking In Bytes
Reply With Quote
  #7  
Old 12-20-2004, 23:52
Kyrios Kyrios is offline
Friend
 
Join Date: Feb 2003
Posts: 48
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Kyrios Reputation: 0
Quote:
PS: My next dUP version will support this MemCheck Method. so you can create
loaders for many asprotect apps.
Will it kill the days limitation and/or executions limitations? If not, it will be useless.


kyrios
Reply With Quote
  #8  
Old 12-21-2004, 00:36
diablo2oo2's Avatar
diablo2oo2 diablo2oo2 is offline
Family
 
Join Date: Mar 2004
Posts: 231
Rept. Given: 6
Rept. Rcvd 111 Times in 26 Posts
Thanks Given: 0
Thanks Rcvd at 6 Times in 6 Posts
diablo2oo2 Reputation: 100-199 diablo2oo2 Reputation: 100-199
Quote:
Will it kill the days limitation and/or executions limitations? If not, it will be useless.
well you have to patch yourself.for me this feature is usefull,so that i can make loaders for apps with process crc checks. many asprotected apps dont use days limit or execution limit from asprotect.a lot of authors code their own registration scheme.

this "limitation and/or executions limitations" which you mean are stored in registry. you can clean them:
http://diablo2oo2.di.funpic.de/downloads/DelAsprKeys.rar

anyway asprotect is not the only one protector which has process crc checks.
__________________
Thinking In Bytes
Reply With Quote
  #9  
Old 12-21-2004, 00:49
Kyrios Kyrios is offline
Friend
 
Join Date: Feb 2003
Posts: 48
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
Kyrios Reputation: 0
i saw inline patching on ASPRed 1.31 which is pretty amaze me how they did it. I'm sure they use blacklisted key because the program run fully registered.
Advanced MP3 Catalog Pro 3.16 for instance by sthepenteh (from Ressurect team).
Another one is Astonshell 1.9 by someguy (from underPL?)
Any tool or tut will be definitely usefull for everyone else. Ofcourse tut is much more precious.


kyrios
Reply With Quote
  #10  
Old 12-21-2004, 02:00
Crk
 
Posts: n/a
Will it kill the days limitation and/or executions limitations? If not, it will be useless.

don't pretend a loader maker or patch maker will do everything for you.. you most find the bytes to crack the app. at the end that's all you want.. you can kill, by finding the needed bytes, time execution or time limit for any asprotect app. without any special option... have use of debugger and some dead code analisys.

i saw inline patching on ASPRed 1.31 which is pretty amaze me how they did it. I'm sure they use blacklisted key because the program run fully registered.
Advanced MP3 Catalog Pro 3.16 for instance by sthepenteh (from Ressurect team).
Another one is Astonshell 1.9 by someguy (from underPL?)
Any tool or tut will be definitely usefull for everyone else. Ofcourse tut is much more precious.


there's some new method or tool they use for asprotect 1.x-2.x
and it looks they don't even need OEP for the inline patch.... just the bytes to crack the app..... still haven't seem any info. about this maybe it's private and maybe noone who knows it will make it public to make hard time To Alexey

Last edited by Crk; 12-21-2004 at 02:04.
Reply With Quote
  #11  
Old 12-21-2004, 03:27
BetaMaster BetaMaster is offline
Friend
 
Join Date: Dec 2002
Posts: 77
Rept. Given: 6
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 2 Times in 2 Posts
BetaMaster Reputation: 3
there seems to be a weekness in crc checking of aspr'd programs in the protectd/encrypted data not the code.

some crackers enject code in that area, which makes a call to certain address in which they place the required instructions.you can trace the decompression/decryption routine to see what to enject to get the required call to that address.

examples of aspr'd targets that were attacked by that method are iso commander 1.5.052,1.50.060, reget deluxe 4.1.241 (twice by tsrh and digiratti).
Reply With Quote
  #12  
Old 12-21-2004, 04:40
bedrock's Avatar
bedrock bedrock is offline
Friend
 
Join Date: May 2002
Posts: 91
Rept. Given: 8
Rept. Rcvd 5 Times in 2 Posts
Thanks Given: 5
Thanks Rcvd at 1 Time in 1 Post
bedrock Reputation: 5
I spoke with stephenteh of team RES via PM to ask him about aspr method, which he also used on Gene6 FTP server, he told me he learnt method from cracks that revenge crew used hxxp://revenge.crackdb.com/ but ther is no info on there web site.

I looked at Gene6 patch, it only seems to change 4 bytes, plus change section length to include registration data, it looks to me like the encryption has broken somehow, caus the 4 bytes decrypt to different code after aspr decryption.

i am still looking for more info on this method

--
bedrock
Reply With Quote
  #13  
Old 12-21-2004, 12:36
BetaMaster BetaMaster is offline
Friend
 
Join Date: Dec 2002
Posts: 77
Rept. Given: 6
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 2 Times in 2 Posts
BetaMaster Reputation: 3
Quote:
4 bytes decrypt to different code after aspr decryption
of course that's the main idea.all you have to do is to hack the loop where the data is decompressed/decrypted, make some changes at the end of the loop, which makes the process continue for certain bytes until they reach the desired values.
Reply With Quote
  #14  
Old 12-24-2004, 02:56
the_beginner the_beginner is offline
Friend
 
Join Date: Feb 2004
Location: Germany
Posts: 85
Rept. Given: 114
Rept. Rcvd 13 Times in 7 Posts
Thanks Given: 97
Thanks Rcvd at 16 Times in 9 Posts
the_beginner Reputation: 13
@JMI
PHP Code:
the_beginner:

Small lesson in proper English spellingsimply because your effor makes a word you do not intend

You keep spelling the English word "got" (erhalten) as "god" which is the English word for GottMajor differenceI know that in German a "d" at then end of a word can sometimes be pronounced as "t" but that is a rather important word not to use by mistakeVerstehen?  

Regards
ok ok My English is very bad,but Nobody is Perfect


@diablo2oo2

Many thanks,I hope this help me


(Ich knnte auch Schreiben vielen Dank denn Du kommst ja auch aus dem Deutschland oder wie kommt man zu einer .de Adresse :-) )

cu
Reply With Quote
  #15  
Old 12-24-2004, 10:34
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
the_beginner:

Nobody is criticizing your English or suggesting it is 'bad." I simply pointed out that one small letter made a very important difference in those two words, an error which you might want not to make. And thanks for the offer.

Regards,
__________________
JMI
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Loader or inline-patching for Safecast. SystemeD General Discussion 1 05-20-2005 19:46
Questions about Inline patch for unpacking t4d General Discussion 1 01-14-2004 13:49


All times are GMT +8. The time now is 22:36.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )