Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 09-19-2003, 20:30
ysco
 
Posts: n/a
How to unpack delphi ???

Hello guys i have a proggie named (Registry Defragmentation
for Windows NT/2000/XP/2003) that i want to try to crack.
I scanned the proggie with stud_PE and the protection whas upx so i unpacked it succesful scanned it again and now says packed with borland /Delphi so my question is what program i must use to unpack Delphi or is it already unpacked ???? Proberly i stupid question from a newbie
If i try to set breakpoints in Ollydbg then i get also this message:
Module (MK2) has entry point outside the code (as specified in the PE-Header) mabye this file is self-exstracting or self-modifying please keep this in mind setting the breakpoints.


Program download (If you wanna look) : _http://www.elcor.net/download/rdefrag.exe

Homepage: _http://www.elcor.net

Any help would be great.

ysco.

Last edited by ysco; 09-19-2003 at 20:58.
Reply With Quote
  #2  
Old 09-19-2003, 22:25
R@dier
 
Posts: n/a
ysco,
Delphi is a programming language created by borland, its not a packer /protector

I would say its unpacked

Regards
R@dier
Reply With Quote
  #3  
Old 09-19-2003, 23:42
ysco
 
Posts: n/a
Thanks for the reply r@dier now i know that this is oke.
But can you give me also a answer on this 1 (If i try to set breakpoints in Ollydbg then i get also this message:
Module (MK2) has entry point outside the code (as specified in the PE-Header) mabye this file is self-exstracting or self-modifying please keep this in mind setting the breakpoints)


Thanks in advance .

ysco.
Reply With Quote
  #4  
Old 09-19-2003, 23:53
alephz alephz is offline
VIP
 
Join Date: May 2002
Location: Israel
Posts: 390
Rept. Given: 126
Rept. Rcvd 291 Times in 93 Posts
Thanks Given: 180
Thanks Rcvd at 69 Times in 23 Posts
alephz Reputation: 200-299 alephz Reputation: 200-299 alephz Reputation: 200-299
Re: How to unpack delphi ???

Quote:
Originally posted by ysco
Program download (If you wanna look) : _http://www.elcor.net/download/rdefrag.exe
Any help would be great.
ysco.
This proggy have a set EXE:

150528 2003-09-18 21:27:23 E76A353CBF3369C1D76D398EE7DDDA31 RegBackup.exe
147968 2003-09-18 21:46:27 CC41F116FB1228A12855F27F5385B376 RegDefrag.exe
153600 2003-09-16 17:23:49 EB71E4FB74C562B4C53455FE0A066DDB RegDfrgSch.exe
489984 2003-09-18 20:53:08 7F233E4CE178B095FB232985954FD307 RegToolkit.exe

and only one packed with UPX - RegToolkit.exe. It's packed only
once - don't need unpack it twice :-)

But all the rest packed with ASProtect 1.23, so i think RegToolkit.exe is only shell - nothing to crack within - and only
other files are really protected.
Reply With Quote
  #5  
Old 09-20-2003, 00:15
ysco
 
Posts: n/a
I have indeed unpacked regtoolkit but if i read it correct then you say this is not the one to crack .
Must i unpack all the others to exe files too crack this proggie ??? or is there only one file that will do the trick.
I thought that the regtoolkit whas the importent 1 because it whas the main program.
Hmmm so you see that everytime you learn something.

Thanks in advance.

ysco.
Reply With Quote
  #6  
Old 09-20-2003, 00:25
R@dier
 
Posts: n/a
ysco,

stripper v2.03 seems to unpack the other files successfully but
I have not worked out how to fix them yet.

00:17:30 - asprotect detected..
Image Base :00400000
00:17:30 - dumping victim..
00:17:30 - processing import table..
ImportAddressTable RVA :0001a154 - kernel32.dll
ImportAddressTable RVA :0001a1f0 - user32.dll
ImportAddressTable RVA :0001a204 - advapi32.dll
ImportAddressTable RVA :0001a214 - oleaut32.dll
ImportAddressTable RVA :0001a224 - kernel32.dll
ImportAddressTable RVA :0001a238 - advapi32.dll
ImportAddressTable RVA :0001a26c - kernel32.dll
ImportAddressTable RVA :0001a338 - version.dll
ImportAddressTable RVA :0001a348 - gdi32.dll
ImportAddressTable RVA :0001a3d0 - user32.dll
ImportAddressTable RVA :0001a4e4 - shell32.dll
ImportAddressTable RVA :0001a4f0 - ole32.dll
ImportAddressTable RVA :0001a4fc - comctl32.dll
ImportAddressTable RVA :0001a504 - shell32.dll
ImportAddressTable RVA :0001a510 - comctl32.dll
ImportAddressTable RVA :0001a520 - winmm.dll
00:17:31 - fixing import table..
ImportAddress RVA :0001a198 - kernel32.dll!GetModuleHandleA
ImportAddress RVA :0001a1a8 - kernel32.dll!GetCommandLineA
ImportAddress RVA :0001a230 - kernel32.dll!GetModuleHandleA
ImportAddress RVA :0001a2d0 - kernel32.dll!GetModuleHandleA
ImportAddress RVA :0001a2f8 - kernel32.dll!GetCurrentProcess
ImportAddress RVA :0001a2fc - kernel32.dll!GetCommandLineA
00:17:35 - 00bh stolen bytes are found..
EntryPoint RVA :00017a10
! public release
! some files will be not unpacked
00:17:35 - saving unpacked file..
00:17:35 - file was unpacked successful..
00:17:35 - done..
Reply With Quote
  #7  
Old 09-20-2003, 00:43
ysco
 
Posts: n/a
Thanks R@dier i will also have a look with stripper.

ysco.
Reply With Quote
  #8  
Old 09-20-2003, 03:13
Jay Jay is offline
VIP
 
Join Date: Feb 2002
Posts: 249
Rept. Given: 31
Rept. Rcvd 3 Times in 3 Posts
Thanks Given: 15
Thanks Rcvd at 13 Times in 5 Posts
Jay Reputation: 3
rdf20

I did previous version, lots of dump checks, write to api address, one of these procs decrypted at runtime, checks ep in pe-header etc. I didn't use stripper so don't know how well it works but looks like still a bit of work after using stripper.
regards
Reply With Quote
  #9  
Old 09-20-2003, 07:24
ysco
 
Posts: n/a
I have try`t it but i can get it to work this is to hard for a learning newbie
Will try something else now.

Thanks anyway guys i still learned something from this.

ysco.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Keygenning With Delphi: Useful Delphi Functions and Tips chessgod101 General Discussion 5 01-05-2015 23:02


All times are GMT +8. The time now is 16:12.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )