|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
 |
|
Hi my friends,can someone tell me what kind protection use this aplication? 
| Astatalk download freehost links: |
| Code: |
| http://www.reasoft.com/products/reajpeg/download.html |
|
It is the pro version!I used peid,exeinfo,and rdg but nothing!RDG say execryptor,but i am sure that is false.Any suggestion how unpack this aplication? |
_________________
|
|
 Date Posted:Tue May 05, 2009 12:02 pmThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi,
it´s ExeCryptor.You can use the RC2 unpacker to unpack it.Choose the option Copy / Paste original IAT in Dump and let it unpack.
greetz |
|
|
Date Posted:Tue May 05, 2009 1:03 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
Believe me LCF-AT i done exactly this that you say to me yestereday night!But if you see is stay packed!!!Correct me if i am wrong...  And give me the unpacked file if you can...  |
_________________
|
|
Date Posted:Tue May 05, 2009 1:16 pmThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi,
1. Unpack this file with the RC2 unpacker / choose copy / paste IAT...
2. Some APIs are there and some are using direct addresses to trace.
3. Now load this dump in Olly you are at the OEP.
4. Use the EXECryptor 2.x IAT rebuilder by PE Kill / enter IAT start & end.
5. Let run the script till finished.All APIs are there now.
6. Attach in ImpRec.Enter data OEP IAT start & Size.
7. Save the infos as tree.txt file.
8. Load the unpacked file in Olly
9. Attach file in ImpRec & load the tree.txt file.
10. Just fix your file now.All APIs are to read now.
11. etc...
greetz |
|
|
Date Posted:Tue May 05, 2009 1:43 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
| Can you please post the script?I can't find in google,all is i chinese! |
_________________
|
|
Date Posted:Tue May 05, 2009 1:57 pmThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
|
Date Posted:Tue May 05, 2009 2:10 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
| LCF-AT in the begin the script run perfectly,but sometime ollydbg show me an error:"Don't know how to step because memory at address 00000011 is not readable.Try to change EIP or pass exception to program"... What i am doing wrong? |
_________________
|
|
Date Posted:Tue May 05, 2009 2:18 pmThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi,
script is working till the end.
Set your Olly custom exceptions to 00000000-FFFFFFFF then try it again.
greetz
EDIT: Don´t forget to patch the CRC checks in this unpacked {2.4.1 EC version}file.If you not patch then you will get the "File corrupted" message {sooner or later}.It´s better to do this so then you can debug the unpacked file without to get any problems. |
|
|
Date Posted:Tue May 05, 2009 7:09 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
Hi LCF-AT,can you please be more specific in CRC patching,how i can do it that?I scan the unpacked with peid and cryptoanalyzer,but this aplication have many references CRC's!I need your help and i apreciate it untill now all that you told to me! Yes,aplication must patching the CRC because i have problem when i try to set breakpoint's.
EDIT:Which ollydbg modification you use it? |
_________________
|
|
Date Posted:Wed May 06, 2009 10:30 amThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi BOSCH,
CRC´s 2.4.x
| Astatalk download freehost links: |
| Code: |
Search for all...
setnz byte ptr [ebp-9]
0F9545F7 // binary
and change to
mov byte ptr [ebp-9]
C645F700 // binary
There are six |
|
After patching you can work correctly.
PS: So I use my own self made Olly mod.
greetz |
|
|
Date Posted:Wed May 06, 2009 11:04 amThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
LCF-AT,i done this that you told me in olly,search for all commands setnz byte ptr [ebp-9] but olly find just SETNE BYTE PTR [EBP-9] and it is one!All this i suppose in unpacked with execryptor unpacker file.Correct me please anything that i do wrong... 
EDIT:this crc's 2.4.x how did you find it?And i say which version you use it,because maybie my olly,have some plugin's activated which make olly crash!When run the script the plugins must be activated???  |
_________________
|
|
Date Posted:Wed May 06, 2009 11:22 amThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi,
yes SETNE is right.setnz is the same its like JNE / JNZ you know.
| Astatalk download freehost links: |
| Code: |
00419C47 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
0068D076 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
0068D1A8 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
0068E893 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
0068ED70 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
00871316 0F9545 F7 SETNE BYTE PTR SS:[EBP-9]
to
MOV BYTE PTR SS:[EBP-9],0 |
|
Hmm, I don´t know why the IAT script crashes for you.So you have set your exceptions to 0-F right?So it should work also for you.If not then try this.The IAT starts at...
0084A438 | 40009B58 rtl90.@System@initialization$qqrv
Now scroll down till the first address where is no API.Enter this address in the script and as end you take the right end 0084BBFC.Now load your unpacked file of the Unpacker and go in the dump at the start of fixing the IAT.Set the dump view to long/address then you can see all fixed APIs better.Let run the script till it crashes then go back to start of fixing and you all fixed APIs till the crash.Copy all as binary string in a txt file.Restart the file and go to the start address in dump and paste what you have till now.Now take the next address and enter this in the script as start address of fixing.Now let again run the script.You have to do this so long till you have all APIs then restart and paste and make a fix with ImpRec.So I had also this problem earlier in some EC app´s-
Disabling CRC checks by kioresk
greetz |
|
|
Date Posted:Wed May 06, 2009 12:17 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
Ok LCF-AT i will unpack it!But if you want and you agree with me sometime give us a tutorial unpacking with this protection if you can...It will be very nice!!!!  Just a little suggestion... |
_________________
|
|
Date Posted:Wed May 06, 2009 12:46 pmThanks: 62Thanked 7 Times In 6 Posts
|
| Author |
Message |
LCF-AT
Special Member
Joined: 17 Jan 2008
Posts: 205
Location: Chateau-Saint-Martin
|
| |
|
Hi,
just some info for you.Look the pic.
| Astatalk download freehost links: |
|
So I do not unpack EC app´s anymore manually except sometimes if the unpacker makes some trouble.I have written some EC tuts earlier but not in english about unpacking.So till now there are a lot EC unpack tuts to get so it´s not needed to write one more EC unpack tut.If you know later the basic`s about unpacking EC then you can also get deeper.Good infos can you get by kioresk tuts about CRC´s,dumping,APIs etc.ExeCryptor (The Internals) by Zool@nder is also a good deeper tutorial + tools which are helpful.Just have a look on this if your are interested.
greetz |
|
|
Date Posted:Wed May 06, 2009 3:46 pmThanks: 0Thanked 44 Times In 29 Posts
|
| Author |
Message |
BOSCH
Special Member
Joined: 20 Oct 2008
Posts: 143
Location: Somewhere outside!
|
| |
|
Now,look LCF-AT what you done to me!  Now tell me how do you activated?Do you unpack it,or just you patch the original?Please at least give me this a link for this tutorials because it is a little dificult to find them all...Thank you again! |
_________________
|
|
Date Posted:Wed May 06, 2009 4:12 pmThanks: 62Thanked 7 Times In 6 Posts
|
Astalavista Forum Index :: Unpacking :: unknown protection?
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
