Go Back   Exetools > General > General Discussion


Thread Tools Display Modes
Old 04-03-2011, 18:19
infern0 infern0 is offline
Join Date: Dec 2004
Posts: 72
Rept. Given: 4
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 2 Times in 2 Posts
infern0 Reputation: 0

is it possible to get code from protected encrypted blocks ? or just manual breakin and dump ?
Reply With Quote
Old 05-26-2011, 08:58
Pansemuckl Pansemuckl is offline
Join Date: Nov 2005
Posts: 34
Rept. Given: 5
Rept. Rcvd 4 Times in 2 Posts
Thanks Given: 15
Thanks Rcvd at 44 Times in 15 Posts
Pansemuckl Reputation: 4
Id be interested in it too
Reply With Quote
Old 05-26-2011, 15:03
DARKER DARKER is offline
Join Date: Jul 2004
Location: Côte d'Ivoire
Posts: 307
Rept. Given: 13
Rept. Rcvd 91 Times in 36 Posts
Thanks Given: 2
Thanks Rcvd at 193 Times in 78 Posts
DARKER Reputation: 91
Try look on "SVKP Explorer" maybe it help you little bit. I think last public version is 0.2e.
Reply With Quote
Old 06-05-2011, 18:34
orfei orfei is offline
Join Date: Aug 2010
Posts: 117
Rept. Given: 31
Rept. Rcvd 60 Times in 36 Posts
Thanks Given: 11
Thanks Rcvd at 76 Times in 34 Posts
orfei Reputation: 60
Is possible in hand (or script) with olly. I do decryption several times before long time.
Basicly in manual mode (and as i remember):
1. Break on OEP.
2. Find where is encrypted code block/s by comparing svkp begin marker.
3. Set new origin on start code block. Step several times to run over decryption routine.
You will see how below code is decrypted (and looks like x86 code).
4. Asemble start/end of crypted code block with jmp (to avoid crypt again and to make good code for dumping).
5. Do above procedure for all crypted blocks.
6. Return origin to OEP and dump.
now is time for imp reconstruction
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
SVKP 1.3x unpacking codeX General Discussion 10 01-28-2005 22:03
The new svkp 143 britedream General Discussion 3 09-19-2004 22:22

All times are GMT +8. The time now is 12:08.

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )