Contribute  :  Web Resources  :  Past Polls  :  Site Statistics  :  Downloads  :  Forum  
    BiW ReversingThe challenge is yours    
 Welcome to BiW Reversing
 Tuesday, February 19 2019 @ 08:38 AM CET
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

SafeDisc 4.00.003 -> Macrovision [Overlay]

 
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking
View previous topic :: View next topic  
Author Message
crackee
Occasional Poster
Occasional Poster


Joined: 27 Jan 2006
Posts: 30

PostPosted: Thu Mar 16, 2006 8:01 pm    Post subject: SafeDisc 4.00.003 -> Macrovision [Overlay] Reply with quote

Does anyone have any ideas on how to unpack this packer "SafeDisc 4.00.003 -> Macrovision [Overlay]". I'm trying to unpack a target which has some sort of Debugger detection that I cannot by pass with well known Olly plugins (Hide Debugger, IsDebug, .etc..) Also, I've tried IsDebuggerPresent, OutputDebugStringA, CreateToolhelp32Snapshot API's but non prevailed.
By the way, I've loaded the target here if anyone interested. Sorry, it's about 10MB, lol.

http://rapidshare.de/files/15683089/AM2006.rar.html

As usual, thanks in advance.

Shocked Laughing Crying or Very sad


Last edited by crackee on Thu Mar 16, 2006 11:13 pm; edited 1 time in total
Back to top
View user's profile Send private message
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Thu Mar 16, 2006 9:30 pm    Post subject: Reply with quote

When I try to run the .exe it fails with the message that it needs FILEIO.DLL,
you might wanna upload that one too ?
Back to top
View user's profile Send private message
crackee
Occasional Poster
Occasional Poster


Joined: 27 Jan 2006
Posts: 30

PostPosted: Thu Mar 16, 2006 11:14 pm    Post subject: Reply with quote

Sorry mate... I had just re-edited the post and replaced the files with the complete version. Thanks!

Very Happy Shocked
Back to top
View user's profile Send private message
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Fri Mar 17, 2006 1:14 pm    Post subject: Reply with quote

Download the 'Advanced Olly beta 15' plugin from http://omega.intechhosting.com/~access/forums/index.php?showtopic=2542&st=40

and check all the anti-anti-debugging except NtGlobalFlag ... Olly won't be detected anymore and you'll get a 'missing CD' message Smile

Good luck !
Back to top
View user's profile Send private message
crackee
Occasional Poster
Occasional Poster


Joined: 27 Jan 2006
Posts: 30

PostPosted: Fri Mar 17, 2006 6:25 pm    Post subject: Reply with quote

Thank you Skilla. Would you mine pm the plugin to me 'cause the link is dead... I got this message:

"Sorry, the link that brought you to this page seems to be out of date or broken.''

By the way, do you know what method does it use to detect debugger here?

Thanks,

Very Happy Laughing Sad
Back to top
View user's profile Send private message
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Sat Mar 18, 2006 12:12 am    Post subject: Reply with quote

The link above is working fine for me, were you logged on ?

Anyways, I sent the PM Smile

I'm not sure which tricks are used to detect Olly, it detected my ShadowOlly with lots of plugins from my Virtual Machine without the ant-anti turned on. You can try & see which options are necessary by checking them one by one, I haven't tried yet ...
Back to top
View user's profile Send private message
crackee
Occasional Poster
Occasional Poster


Joined: 27 Jan 2006
Posts: 30

PostPosted: Sat Mar 25, 2006 1:09 am    Post subject: Reply with quote

Yike.... this is a tough one. I was able to by passed the debugger check, however, unpacking this so called "SafeDisc" isn't easy at all. Does anyone out there have any ideas on how to unpacked this baby? Man, I should not pick this target for pracetice- Bad choice! But, I hate to give up... Sad

Thanks in advance!

Shocked Confused Crying or Very sad
Back to top
View user's profile Send private message
thorpe
Regular
Regular


Joined: 28 Apr 2005
Posts: 125

PostPosted: Sun Mar 26, 2006 7:31 am    Post subject: Reply with quote

safedisc is quite difficult for beginners. As for many things, looking at prior research by others may help you on your quest. I suggest you look at tutorials by Tola, yAtEs, or others which can easily be found on google. Good luck.
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Wed May 31, 2006 10:28 am    Post subject: Reply with quote

indeed, not very usefull for a first target, also checking out Old tuts wont help you..since they added/changed a few things..thou basics are the same..but id recommend looking allot into the PE structure and Reading up on Loaders and that sort of stuff.... also a good knowledge of ASM and Decompiling would be usefull Wink but try to unpack orther stuff first..then if you start to get a hang of it...dedicate some time for SafeDisk and start mapping it..
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
crackee
Occasional Poster
Occasional Poster


Joined: 27 Jan 2006
Posts: 30

PostPosted: Wed Jun 07, 2006 11:58 pm    Post subject: Reply with quote

Thank you... I'll see if I can sink anymore information into my head. I hope I won't overheat my brain... Laughing Wink
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Wed Jul 05, 2006 11:23 am    Post subject: Reply with quote

66703017 E8 E6+ call CheckForDebugger ; //if Eax != 10000 then Debugger is present
.txt2:6670301C 3D 00+ cmp eax, 2000h
.txt2:66703021 59 pop ecx
.txt2:66703022 59 pop ecx
.txt2:66703023 74 26 jz short loc_6670304B
.txt2:66703025 3D 00+ cmp eax, 4000h
.txt2:6670302A 74 D9 jz short loc_66703005
.txt2:6670302C 33 C9 xor ecx, ecx
.txt2:6670302E 3D 00+ cmp eax, 10000h


your magic DebugCheck Smile ... can be identified by looking for the unicode string
represitantion of 00010000 which should look like this CMP EAX,10000 ; UNICODE "=::=::\"

_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking All times are GMT + 1 Hour
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
 Copyright © 2019 BiW Reversing
 All trademarks and copyrights on this page are owned by their respective owners.
Powered By Geeklog 
Created this page in 0.09 seconds