#1
|
|||
|
|||
Armadillo in Polyphonic Wizard v3.5
Hi,
I'm working on Polyphonic Wizard v3.5, from h**p://www.polyphonicwizard.com PEiD says it's packed with Armadillo 3.78.I've found the OEP and dumped it.In Imprec it shows a number of invalid trunks and i managed to fix a few of them.Then i cut the remaining trunks and fixed the dump.To my surprise this VB app runs. Now the problem is when i choose exit or click on Close button it crashes saying Quote:
|
#2
|
|||
|
|||
as far as i know arma protected vb program only have 1 invalid api... that's __vbaEnd
so probably u never fix that api... |
#3
|
|||
|
|||
While we have an active topic within reason, I'll pop my question in here.
I too have been trying to unpack an application that shows Armadillo 3.78 as the packer. I have found what I believe is the Entry point and used ollydump to dump the file. I'm stuck trying to use Imprec to rebuild the IAT, and seem to be getting no where fast. I've tried my best to use imprec with this packer, though I don't think I fully understand what to do. I can't run the dumped exe because of this, so I just opened it in olly to use imprec on the dumped file. Is this the correct way about going at this? Perhaps someone can help me with this subject. Thank you. |
#4
|
|||
|
|||
Hi,
maybe this thread: _http://forum.exetools.com/showthread.php?t=6664 -> Armadillo 4.xx standard unpacking by DappA will help you .. covers IAT stuff ... i hope it works for you ... _veDc EDIT: Just deleted the not working URL Tag .. sorry .. Last edited by _veDc; 04-27-2005 at 19:02. |
#5
|
|||
|
|||
Why version 3.5 while 4 is already out? For educational purposes?
|
#6
|
|||
|
|||
Quote:
EDIT: Added required dll to the attachment. Last edited by AdamD; 04-29-2005 at 04:46. |
#7
|
|||
|
|||
Try This..
hxxp://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=6&topic=1105
|
#8
|
|||
|
|||
Finding the OEP isn't what I'm looking for. I can't figure out how to rebuild the IAT with the tutorial posted. The OEP for my attached file is 00029B73
|
#9
|
|||
|
|||
Quote:
btw yor attachment doesn't work |
#10
|
|||
|
|||
I fixed the attachment by adding a required dll to the zip file. This is a client that is initialized by web browser, so when ran just executed by itself, it has no gui without javascript running their gui dlls. Any help is appreciated, this has been a big challenge for me.
|
#11
|
|||
|
|||
AdamD Verified your OEP ;-) , program is protected with code splicing this is the main problem for the rebuild of the IAT. Probable you already know this information.
If i've time i'll look at the IAT problem |
#12
|
|||
|
|||
Thankx friends....
stephenteh , i'm gonna to test that api __vbaEnd. But I got a lot of invalid trunks and all of which can be disassebled in Imprec. |
#13
|
|||
|
|||
codeX i have done version 4.02. But i can't test it. Can you test it for me ? See your PM for link ..
|
#14
|
|||
|
|||
This armadillo used in this app, is very basic, need to fix IAT (Its VB, so Only __vbaEnd) + CODE SPLICE, then just the silly "Armaccess.dll" Bug.
If its needed i can write a little tut for this app as i have some free time this weekend. Cya. |
#15
|
|||
|
|||
Hi Vepergen,
I'm using XP with visual studio installed . But it give's the error i've PMed you. @Peter[Pan] Yes it's very basic protection. I've to fix Quote:
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Conditional BPs made easy (wizard style) | Rhodium | General Discussion | 5 | 01-04-2006 00:17 |