The new svkp 143

[britedream]

I did check it today and found that table and stolen is the same way as in earlier versions, but svkp now changed the indirect address to other address- ExitProcess I think- so there is a table for this that solve this problem as the one below:



009C8DCB 00 00 00 00 B8 C0 40 00 ....&cedil;&Agrave;@. <--- First address
009C8DD3 95 AD 40 00 20 C1 40 00 •­@. &Aacute;@.
009C8DDB 24 AD 40 00 C0 C0 40 00 $­@.&Agrave;&Agrave;@.
009C8DE3 FF AC 40 00 C0 C0 40 00 &yuml;&not;@.&Agrave;&Agrave;@.
009C8DEB 97 AC 40 00 C0 C0 40 00 ¡ª&not;@.&Agrave;&Agrave;@.
009C8DF3 64 AC 40 00 58 C1 40 d&not;@.X&Aacute;@



this is part of the table, the first address-0040c0b8-is the correct address to the iat, the second address is the address where the first address to be moved to correct the problem, so if you make script with a command to mov the first to the second, the problem should be solved,this is what time permit,sorry I didn't have time to write a script to test it , but I think it is easy , this is the only problem I can see now, if any other problem occur please let me know thanks.
[note1]
the last 6 or so addresses are non linear, script can also find them but slightly different way.
[note2]
on top of the ExitProcess indirection there is MessageBox indirection and can be found at the same way as the ExitProcess from within the same table area..
it also changes some of the api move to call ,as ex.: mov ebp, [an api address] ; some code;then call ebp, svkp changes this to call [an api address]; some code; call ebp. it is not limited to ebp it can be esi or edi etc ..
to correct this change the call to mov .

[MaRKuS-DJM]

removed because too informative for SVKP author

i have seen britedream's unpacking works.. i must say very good unpacker .. what about an unpacker for SVKP ?

[britedream]

the restoration of the exitProcess and messagebox redirections are easy done by the script but , the redirection of moves through calls needs some time to write script if possible for it , or you can spend few hours to correct the problem, but you can bypass all that, by just adding two regions, and a missing dll ;if any; that you have to load in either case, for adding regions method:

dump at the oep and fix stolen, no iat fix, the redirected calls will tell you the first region to add, then run the target error msg. will tell you the second region to add, load the missing dll, in my case it was ole32 ,you will know from the error msg., target runs fine.

britedream.