Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-17-2021, 12:00
WillyTerra WillyTerra is offline
Friend
 
Join Date: May 2021
Location: Mars
Posts: 2
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 0 Times in 0 Posts
WillyTerra Reputation: 0
[Help]Armadillo 9.x 64bit Unpack

Hello, Bro
I encountered some troubles in unpacking the armadillo 64bit program.
Below are my unpacking steps. Please check if there are any problems.
Find the protect type.
---------------------------------------
Protected Armadillo
File Size 22058240
Extra data size=13568
Load file
<-Find Protect
Protection system(Professional)
<Protection Options>
Standard protection or Minimum protection
<Backup Key Options>
No Registry Keys at All
<Compression Options>
Minimal/Fastest Compression
<Other Options>
Disable Monitoring Thread
<-Find Version
Version X.XX 04-02-2013
---------------------------------------
1. Place a bp on VirtualProtect Ret.
2. F9-F7 till .reloc appears
3. Take one more F9 (This time it will be a bit longer), then F7 to land on Arma Code.
4. Now landed on Arma Code find ASCII pattern ArmA and scramble it.
5. Find where the API Checking is done.
6. Patch the magic jump.
7. Find a place where the API Methods are loaded and disable the GetTickCount Detection.
8. Dump and fix it.
---------------------------------------
This is my unpack video link:
https://mega.nz/folder/kFAARBJa#F5GCzKTlZpXH9vFte7F6-w

I tested many software in this way, and there was no problem, but now this software just doesn’t work.

Last edited by WillyTerra; 06-17-2021 at 20:14.
Reply With Quote
Reply

Tags
armadillo unpacking

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



All times are GMT +8. The time now is 18:20.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX
( 1998 - 2021 )