#16
|
|||
|
|||
my dump is from the Oep
|
#17
|
|||
|
|||
I did name it as the same as the original program "zup", it works registered
|
#18
|
||||
|
||||
finally, it doesn't matter if it is registered or not... for me it's only the unpacking-practice. but i wondered about the rename thing
|
#19
|
|||
|
|||
in earlier version of asprotect I noticed that it create a text file in the program folder for each dump you run, if you delete this file ,or rename the dump, it will run unregistered, I didn't see these files here, but
it may be created some where else. Last edited by britedream; 12-31-2003 at 00:14. |
#20
|
||||
|
||||
found the code. it's in the dump...
00594614 8BD0 MOV EDX,EAX 00594616 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00594619 8B80 A80A0000 MOV EAX,DWORD PTR DS:[EAX+AA8] 0059461F 8B08 MOV ECX,DWORD PTR DS:[EAX] 00594621 FF51 5C CALL DWORD PTR DS:[ECX+5C] 00594624 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00594627 8B80 000B0000 MOV EAX,DWORD PTR DS:[EAX+B00] 0059462D 33D2 XOR EDX,EDX 0059462F E8 2864FEFF CALL zupa.0057AA5C 00594634 A1 D0AC5B00 MOV EAX,DWORD PTR DS:[5BACD0] <<< checks the dword in 5BACD0 = RVA 5BACD2 00594639 E8 CA64E7FF CALL zupa.0040AB08 0059463E 85C0 TEST EAX,EAX 00594640 76 10 JBE SHORT zupa.00594652 <<< jump UNREGISTERED 00594642 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 00594645 8B80 5C090000 MOV EAX,DWORD PTR DS:[EAX+95C] 0059464B 33D2 XOR EDX,EDX 0059464D E8 CE23EBFF CALL zupa.00446A20 00594652 33C0 XOR EAX,EAX the dword 5BACD0 begins in my dump with B8, in your dump with B7. the solution is to nop the JBE @RVA 00594640 @59A5C3 is another JBE, this must also be nopped. Last edited by MaRKuS-DJM; 12-30-2003 at 21:33. |
#21
|
||||
|
||||
new target: CloneCD 4.3.1.9
i came to the following: stolen bytes: none OEP: 40154C but there's still a read/write error if clone-cd analyses a CD. i think it's a problem with IAT, but all invalid pointers are fixed IAT: |
#22
|
|||
|
|||
your "zup" isn't fully registered, if you
want to make it registered do the following: 1- at address 5be7dc=3d ( this will make us as if we were registered) 2-nop 52a2f6 (will prevent it from change our status in step 1) 52a356 (this will make it think we have a valid lic ) you will no longer have the registration entry. and will be fully registered. Last edited by britedream; 12-31-2003 at 14:55. |
#23
|
||||
|
||||
hm... makes it so much difference?
how did you find that value? only tracing? powerstrip is the harder target... Last edited by MaRKuS-DJM; 12-31-2003 at 01:59. |
#24
|
|||
|
|||
Z-Up v4.3.1
MaRKuS-DJM,
Would you be kind to attach tree.txt for Z-Up Maker last version. I'm working on it but I have error . ( wrong OEP ? ). Regards, Zlatko |
#25
|
||||
|
||||
it's on page one the second post (by britedream)
|
#26
|
|||
|
|||
britedream or Marcus ,
Would you, please, check what is incorrect with this tree.txt . How to decide should will be ADD ESP, -010 or SUB ESP, -0C ? Regards, Zlatko |
#27
|
|||
|
|||
Quote:
at the begging 0014A0EC kernel32.dll 018D GetTimeFormatW at the end 0014B67C crypt32.dll 0085 CryptExportPKCS8 your iat list dont have em |
#28
|
||||
|
||||
@zlatko the esp-value in the dump must match to the esp-value in the original-file @OEP
|
#29
|
|||
|
|||
Markus,
If you have time would you try to work with me on new target ? Pgm. is dumped and IAT is resolved but there is some call ( unresolved ) outside of dump. It is not point to any dll call, just simple compare and jump. It is possible that I didn't resolve Iat correctly. Tree is attached ! Regards, Zlatko |
#30
|
||||
|
||||
it seems there are many pointers which aren't fixed... have you checked britedream's IAT?
|
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
Asprotect 2.1x SKE target | taos | General Discussion | 2 | 12-12-2005 17:04 |