|
|
#1
06-12-2004, 02:20
|
|||
|
|||
|
Hacking Asprotect 1.31
Svensk post a target protected with the new 1.31, the name is dvdIdlepro Version 5.0.1.6 this is the Version as of today.I am not going to unpack it this time, for change, I will hack it. To avoid crc checks I will use the idea brought up by a gentleman called Saccopharynx,Thanks Saccopharynx, but similarity ends here, I will use a different approach.
I coded dll to do all the patches needed as follow: 1- check the first byte of code section for change as signal . 2- go and get the imagebase that be used in the pc from 45c64b for this target. 3- hold asprotect till my dll finishes its calculations of addresses needed to be patched. 4- patch , and let asprotect go on,wait for it to decrypt the location where I will redirect the address to my name as registered.(this step is cosmetic). send me pm if you need detail. your version should be 5.0.1.6 unpack the files and replace yours. Last edited by britedream; 06-12-2004 at 10:09. 
|
|
#2
06-12-2004, 08:17
|
|||
|
|||
|
this will probably only work on winxp because it crashes when it tries to access a static system dll address (possibly kernel32) pointer which doesn't jive with win2k. anyway, it doesn't work on win2k.
on a positive note, this app keeps intact its native iat. so it is easy to rebuild. when i first ran it i thought it was too fast for the new protection. now i know why cuz he didn't use the aspr import handler which adds way too much extra time if you ask me. good for the author and his customers. 
|
|
#3
06-12-2004, 09:54
|
|||
|
|||
|
bollygud, thanks for the feed back, I have no idea about w2k, but for the xp please make sure that you use version 5.0.1.6, and don't change target folder name, so keep it as:
XX:\program files\dvdidle pro\...... Last edited by britedream; 06-12-2004 at 12:17.
|
|
#4
06-12-2004, 13:47
|
|||
|
|||
|
did it work for anyone with xp
if it didn't work while you installed 5.0.1.6 on xp, please tell me what the error MSG.
|
|
#5
06-12-2004, 19:57
|
|||
|
|||
|
Version has changed
the version has changed to 5.0.2.6, two versions changed in one day, they must be reading this forum. our patch will not work on the new version.
it is no longer protected with new asprotect 1.31, it went back to the old one Last edited by britedream; 06-12-2004 at 21:27.
|
|
#6
06-13-2004, 06:44
|
|||
|
|||
|
just so you know, i was using 5.0.1.6. but here's a little crash report:
Quote:
if they went back to the older aspr, that's a good thing for them and their customers. i don't like the way the new aspr runs (which is too slow). programmers who use these protections should always opt for speed cuz even when they use these 'advanced' options it doesn't make it unbreakable for those of us who know the ways around this stuff. if they opt for a slower more heavily protected app you should expect complaints from your customers about sluggish performance. just my 2 cents. Last edited by bollygud; 06-13-2004 at 06:51.
|
|
#7
06-13-2004, 09:34
|
|||
|
|||
|
Thanks for the info
But the call you refer to at address 476fdc is call LoadLibraryA, and it is called the way it should be but I don't know why isnot working on w2k.please try to change it to Call LoadLibraryA, and at address 476fe6 is call GetProcAddress, change these two, and see if it works for you.
|
|
#8
06-13-2004, 11:15
|
|||
|
|||
|
luckily this app incorporates both of those api into its starting imports.
here is some fixed code for this routine: Quote:
nice approach
|
|
#9
06-13-2004, 11:31
|
|||
|
|||
|
I did code it on the xp as call LoadLibraryA and call GetProcAddress, I don't understand why it isnot working on w2k. it is working on my xp. I think mapping these calls are different on w2k.
|
|
#10
06-13-2004, 11:52
|
|||
|
|||
|
Quote:
|
|
#11
06-13-2004, 12:06
|
|||
|
|||
|
yes, i realise that these are standard api's incorporated into aspr'd apps
the reason that your call isn't working is cuz it's pointing directly to an address that simply doesn't exist in win2k. perhaps your kernel32 (or all xp kernel32) is based at 77000000. where mine is based at 7C000000. this isn't a new concept and is the entire reason for the need of an import table and iat. cuz with each system or OS, the api simply do not reside in the same exact address. it seems that since you have the grasp of all these things, and i doubt i need to tell you this. but just in case you didn't know... perhaps the fact that i copy/pasted from olly in haste that is shows the api names is confusing. but if you look what i really did was change the direct calls to indirect calls like so: Quote:
well... it was working, now i get a crc error (aspr virus error) coming from your hack file. strange cuz it was working. o well. Last edited by bollygud; 06-13-2004 at 12:33.
|
|
#12
06-13-2004, 12:26
|
|||
|
|||
|
sorry, but you didnot understand my point , I didnot call the address directly I used call LoadLibraryA, and patched through ollydbg, I understand where the kernel base is,but my point is that calling LoadLibraryA should be resolved by w2k, and it didn't.(thanks for your clarification).
Last edited by britedream; 06-13-2004 at 13:53.
|
|
#13
06-13-2004, 12:38
|
|||
|
|||
|
i see
the thing is, if you patch directly in olly 'call LoadLibraryA' it then codes a direct call to that api. i mean it IS a direct call here is the raw bytes for the two calls: Quote:
sorry mate
|
|
#14
06-13-2004, 12:43
|
|||
|
|||
|
I see it now, ollydbg resolves LoadLibrary to its address in xp when I save the patch, when you run it on w2k the address sure will be different.so to go around it you went after LoadLibrary through the import.thanks fruitful discussion
Last edited by britedream; 06-13-2004 at 14:08.
|
|
#15
06-13-2004, 13:28
|
|||
|
|||
|
Quote:
|
 |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Hacking a VB-Prog | mr Xor | General Discussion | 4 | 02-17-2004 18:38 |
Linear Mode
