Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 01-14-2004, 04:19
Pompeyfan
 
Posts: n/a
Paltalk

It seems that any changes you make to Paltalk.exe, even just unpacking it, and it then lets you sign in, but once in it wont list the chatrooms unless you hit the refresh button a couple of times, then when you click on a group, it works for a few seconds, then the audio and text stops working, but it doesn't give you any error messages, so it really doesn't give you much idea what strings to look for in your debugger, it also doesn't seem to like to run for long in Olly Debug.
What logical reason can their be for a program not functioning, just because it has been unpacked?
Reply With Quote
  #2  
Old 01-14-2004, 04:48
MaRKuS-DJM's Avatar
MaRKuS-DJM MaRKuS-DJM is offline
Cracker + Unpacker
 
Join Date: Aug 2003
Location: Virtual World / Network
Posts: 553
Rept. Given: 7
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 3
Thanks Rcvd at 16 Times in 10 Posts
MaRKuS-DJM Reputation: 6
i don't think unpacking has effects to the functionality... only WRONG unpacking (invalid IAT, etc.)
Reply With Quote
  #3  
Old 01-14-2004, 05:25
volodya
 
Posts: n/a
MaRKuS-DJM

Just to say some bla-bla-bla. In general case you are right, but consider the application that calculates its CRC and, if unpacked, CRC will change and this CRC is involved in come computaions, not just in idiotic

cmp eax, CRC
jnz ok_lets_go_and_kick_their_asses

I met such examples. One was packed with Aspack and after unpacking (really clear one - IAT, TLS, etc) stopped working.
Reply With Quote
  #4  
Old 01-14-2004, 22:43
MaRKuS-DJM's Avatar
MaRKuS-DJM MaRKuS-DJM is offline
Cracker + Unpacker
 
Join Date: Aug 2003
Location: Virtual World / Network
Posts: 553
Rept. Given: 7
Rept. Rcvd 6 Times in 4 Posts
Thanks Given: 3
Thanks Rcvd at 16 Times in 10 Posts
MaRKuS-DJM Reputation: 6
don't thought about that fact... but maybe the crc is easy to find if it is plain, or a bpx on TerminateProcess or PostQuitMessage will help (in general, not for this program)
Reply With Quote
  #5  
Old 01-15-2004, 03:51
Pompeyfan
 
Posts: n/a
But wouldn't the CRC check stop the program from functioning totally, as it stands with this program, you have partial functionality.
Reply With Quote
  #6  
Old 01-15-2004, 05:08
JMI JMI is offline
Leader
 
Join Date: Jan 2002
Posts: 1,627
Rept. Given: 5
Rept. Rcvd 199 Times in 99 Posts
Thanks Given: 0
Thanks Rcvd at 96 Times in 94 Posts
JMI Reputation: 100-199 JMI Reputation: 100-199
volodya is suggesting that the CRC check may only prevent the operation of a specific portion of the code and not JMP to an exit process of the code. In other words, your team is a man short, but still able to attempt to play the match.

Otherwise, it is most likely that you have one or more of the imports incorrectly identified and fixed and that is preventing all of the programs features from operating correctly, although it does run. Another possibility is that you forgot to adjust for the unpacking and the virtual vs physical addresses changes.

Regards,
__________________
JMI
Reply With Quote
  #7  
Old 01-16-2004, 02:09
dj-siba's Avatar
dj-siba dj-siba is offline
Musician Member
 
Join Date: Jun 2003
Location: Outside the dot
Posts: 324
Rept. Given: 34
Rept. Rcvd 43 Times in 21 Posts
Thanks Given: 56
Thanks Rcvd at 159 Times in 43 Posts
dj-siba Reputation: 42
Pompeyfan:

some program don't stop functioning totally but continue with less features when bad CRC...
Reply With Quote
  #8  
Old 01-16-2004, 04:05
Pompeyfan
 
Posts: n/a
Quote:
Another possibility is that you forgot to adjust for the unpacking and the virtual vs physical addresses changes.
Okay, I'm still pretty new to unpacking, can you expand upon this a bit, just so that I can get myself back into the game, before the coach makes a substitution
Reply With Quote
  #9  
Old 06-08-2016, 01:21
c4p0ne's Avatar
c4p0ne c4p0ne is offline
Friend
 
Join Date: Jul 2002
Location: n/a
Posts: 83
Rept. Given: 1
Rept. Rcvd 1 Time in 1 Post
Thanks Given: 2
Thanks Rcvd at 0 Times in 0 Posts
c4p0ne Reputation: 1
Are there any tutorials on stripping VM detection from the latest Paltalk executable (11.7.640.17816)? That is to say, either preventing Paltalk from shutting down upon detecting itself running inside a VM, or fooling the program into thinking that it isn't running inside a VM?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 16:39.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )