Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #31  
Old 06-02-2004, 11:21
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To Ferrari

This target is much easier than whereIsIt, just fix the iat and it will run fine,

here is the iat to compare to: (don't use it on yours, it will not work,just compare it to your iat.)

note: i have the target unpacked , if you want, I will be glad to send it to you.
Attached Files
File Type: txt treefinal.txt (21.9 KB, 16 views)

Last edited by britedream; 06-02-2004 at 16:22.
Reply With Quote
The Following User Says Thank You to britedream For This Useful Post:
Indigo (07-19-2019)
  #32  
Old 06-02-2004, 11:30
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To Ferrari

Quote:
Originally Posted by ferrari

Error: Access violation while reading [1181B34]

00407294 $- FF25 C841C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetModuleFileNameA
0040729A 8BC0 MOV EAX,EAX
0040729C $- FF25 CC41C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetModuleHandleA
004072A2 8BC0 MOV EAX,EAX
004072A4 $ FF25 341B1801 JMP DWORD PTR DS:[1181B34]
004072AA 8BC0 MOV EAX,EAX
004072AC $- FF25 D041C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetProfileStringA
004072B2 8BC0 MOV EAX,EAX
004072B4 $- FF25 D441C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetStdHandle

How to fix this plz help.

Regards,

here is the same code in my unpacked target:

00407294 - FF25 C041C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetMod>; kernel32.GetModuleFileNameA
0040729A 8BC0 MOV EAX,EAX
0040729C - FF25 C441C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetMod>; kernel32.GetModuleHandleA
004072A2 8BC0 MOV EAX,EAX
004072A4 - FF25 7C47C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetPro>; kernel32.GetProcAddress
004072AA 8BC0 MOV EAX,EAX
004072AC - FF25 C841C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetPro>; kernel32.GetProfileStringA
004072B2 8BC0 MOV EAX,EAX
004072B4 - FF25 CC41C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetStd>; kernel32.GetStdHandle
004072BA 8BC0 MOV EAX,EAX
004072BC - FF25 D041C100 JMP NEAR DWORD PTR DS:[<&kernel32.GetStr>; kernel32.GetStringTypeExA

Last edited by britedream; 06-02-2004 at 11:32.
Reply With Quote
The Following User Says Thank You to britedream For This Useful Post:
Indigo (07-19-2019)
  #33  
Old 06-02-2004, 12:13
Crk
 
Posts: n/a
i don't get any knowledge getting an unpacked exe from someone .. i don't have fun like that.. i need some papel/notes about unpacking this latest Aspr. specially fixing IAT
Reply With Quote
  #34  
Old 06-02-2004, 19:46
el-kiwi
 
Posts: n/a
Quote:
Originally Posted by ferrari
TARGET: http://www.jufsoft.com/badcopy

Protection: Latest ASProtect

Used Britedream's Olly script for "ASPR 1.3b" and got to OEP

Without using Ollyscript I did this to get to the OEP.

Hit Shift+F9 26 times and here:
0115E56E 0156 00 ADD DWORD PTR DS:[ESI],EDX

Put BP here:
0115E588 833D 6C3B1601 00 CMP DWORD PTR DS:[1163B6C],0

And hit Shift+F9 and Olly breaks. Then Alt+M and put BP on memory access on code. Then Set the debugging options and hit F9 once and you are at the OEP(Remove analysis) with no stolen bytes.

00501184 55 PUSH EBP
00501185 8BEC MOV EBP,ESP
00501187 83C4 F0 ADD ESP,-10
0050118A B8 240E5000 MOV EAX,BadCopy.00500E24
0050118F E8 105EF0FF CALL BadCopy.00406FA4


Dumped the target and there were no unresolved pointers and fixed IAT and then dump file.

But target wont run

Error: Access violation while reading [1181B34]

00407294 $- FF25 C841C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetModuleFileNameA
0040729A 8BC0 MOV EAX,EAX
0040729C $- FF25 CC41C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetModuleHandleA
004072A2 8BC0 MOV EAX,EAX
004072A4 $ FF25 341B1801 JMP DWORD PTR DS:[1181B34]
004072AA 8BC0 MOV EAX,EAX
004072AC $- FF25 D041C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetProfileStringA
004072B2 8BC0 MOV EAX,EAX
004072B4 $- FF25 D441C100 JMP DWORD PTR DS:[<&kernel32.>; kernel32.GetStdHandle

How to fix this plz help.

Regards,
regards
ferrari maybe your oep is wrong,i found oep on different way,fix iat and program is working,i m under xp. I attach file,and maybe can help you.
with best wishes
Attached Files
File Type: txt BADCOPY.txt (2.8 KB, 18 views)
Reply With Quote
  #35  
Old 06-02-2004, 20:37
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To el-kiwi

Hi

are you sure it is the same verion BadCopy pro 3.74 build 403.
Reply With Quote
  #36  
Old 06-02-2004, 21:24
el-kiwi
 
Posts: n/a
Quote:
Originally Posted by britedream
Hi

are you sure it is the same verion BadCopy pro 3.74 build 403.
Hi britedream

no it is not,now i see its 3.74 build 0531,but i download it yesterday,and now peid say aspack 1.07b! i dont get it. I apologize for misunderstanding.

Last edited by el-kiwi; 06-02-2004 at 21:54.
Reply With Quote
  #37  
Old 06-02-2004, 21:58
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To el-kiwi

Here is the unpacked Badcopy if you wish to tackle asprotect:
Attached Files
File Type: rar BadCopy_britedream.rar (634.2 KB, 12 views)
Reply With Quote
  #38  
Old 06-02-2004, 23:15
el-kiwi
 
Posts: n/a
its working,I just delete this old one,and programs works fine on my machine.is there any chance to write tutorial about unpacking this version britedream?
Reply With Quote
  #39  
Old 06-03-2004, 00:51
ferrari
 
Posts: n/a
@el-kiwi

OEP is right mate but from britedreams post I see where the problem is.

@britedream
Btw britedream I 'll check ur input and let you know ..I want to know how u did it rather than downloading the unpacked exe

Regards,
Reply With Quote
  #40  
Old 06-03-2004, 01:36
SvensK
 
Posts: n/a
I just grabbed the latest (3.74 0531) version of BadCopy Pro from hxxp://www.jufsoft.com/badcopy/ and that's most definitely not asprotected.
Author must have given up on asprotect.

Edit: Build 0403 couldn't have been Asprotect 1.31, it was way more like 1.23 RC4. Lemme know if I'm mistaken.
Hence, easy to unpack.

Regards
SvensK

Last edited by SvensK; 06-03-2004 at 02:22.
Reply With Quote
  #41  
Old 06-03-2004, 02:22
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
it is 131 to me .
Reply With Quote
  #42  
Old 06-03-2004, 02:24
SvensK
 
Posts: n/a
My file version is 3.7.4.0 and filesize is 587 KB (601 600 bytes).
Are yours different?
Reply With Quote
  #43  
Old 06-03-2004, 02:30
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
size on disk 640kb, and version 3.74 build 403
Reply With Quote
  #44  
Old 06-03-2004, 02:41
SvensK
 
Posts: n/a
Right-click the .exe and check Properties, then Version tab.
What does it say at the top?
Reply With Quote
  #45  
Old 06-03-2004, 03:43
hobgoblin hobgoblin is offline
Friend
 
Join Date: Jan 2002
Posts: 124
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 5 Times in 5 Posts
hobgoblin Reputation: 0
Hmm

I just downloaded and unpacked the latest version myself. It is an old Aspack version (Aspack 1.07).

hobgoblin
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Anyone can help me with this one?? ASProtect loman General Discussion 0 12-31-2003 16:37


All times are GMT +8. The time now is 09:13.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( 1998 - 2024 )