Contribute  :  Web Resources  :  Past Polls  :  Site Statistics  :  Downloads  :  Forum  
    BiW ReversingThe challenge is yours    
 Welcome to BiW Reversing
 Tuesday, February 19 2019 @ 07:54 AM CET
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Elicense/Vprotect unpacking
Goto page 1, 2  Next
 
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking
View previous topic :: View next topic  
Author Message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Sat Jul 15, 2006 6:31 pm    Post subject: Elicense/Vprotect unpacking Reply with quote

ive been working on : hxxp:// www.ootpbaseball2006.com/
ive unpacked it..found OEP...restored IAT...but yet it fails to run correct.. and im clueless...ive been figthing with it for hours...so if anybody wanna look.. plz do so Smile ive added my "unpacked" files


--Soul12

my unpacked files: http://www.yousendit.com/transfer.php?action=download&ufid=9DE3435548217629

thnx in advance

_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
haggar
Regular
Regular


Joined: 19 Mar 2005
Posts: 246

PostPosted: Sun Jul 16, 2006 12:54 pm    Post subject: Reply with quote

Hi

I was thinking to try it, but game is too big for dial-up. Do you know some smaller target ~2-3 MB?


Load your unpacked files in Olly, uncheck exceptions and find where it crushing. After it stops on exception, check stack - maybe address in stack is some call that tries to read empty address.
Search for all intermodular calls and check does it have empty ones, wrong , etc...


Posible CRC checks too?
Back to top
View user's profile Send private message
bengunn
Regular
Regular


Joined: 15 Apr 2005
Posts: 118

PostPosted: Sun Jul 16, 2006 1:49 pm    Post subject: Reply with quote

I'm not sure what he means by vprotect unpacking, the only elicen40 target I ever saw was some virtual destop app called Winspace, but that was in nov 2004 so I don't know if it still has the same protection. Don't remember any particular problems with it, maybe thats where the vprotect? comes in :shrugs:. I'm pretty sure its the same app as this 4.3mb d/l.

http://www.majorgeeks.com/WinSpace_d232.html
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Mon Jul 17, 2006 2:29 pm    Post subject: Reply with quote

thnx 2 hagger for finding my error... when Program is loaded in a debugger its never Decrypts the .exe Completely..and leaves not only OEP but Large parts of the Program broken... and ive never seen this before... thnx 2 hagger!
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Mon Jul 17, 2006 2:31 pm    Post subject: Reply with quote

PS: any idea yet how the debugger is detected ? rdtsc, GetTickCount ?

Did you try unpacking with the Olly Advanced Plugin activated ?
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Mon Jul 17, 2006 3:12 pm    Post subject: Reply with quote

nope, but its something to investiage , but i doubt its something olly advanced wont handle if used
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
haggar
Regular
Regular


Joined: 19 Mar 2005
Posts: 246

PostPosted: Mon Jul 17, 2006 5:30 pm    Post subject: Reply with quote

Hi guys.

I have no idea why OEP bytes are changed, I didn't go too much into it.

Soul, did you done it with changing that OEP jump to EB FE? Is code section OK now?


Also , be sure that you dump with reeading PE header from disk in both ImpREc and LordPE. eLicense screw PE header. You could fix it manually, but why bother. Check does all imports are ok. Then find where file is crushing.


PS

It installs tree files into rooth folder

lcmmfu.cpl
mmfs.dll
Runservice.exe

and one in temp folder which is registration dialog program.

It also writes key in registry with embedded nulls. Use RegDellNul from sysinternals to remove it. After deinstalling target, all files stay on hard drive and they are set to run at windows start. They could at least remove those files.
Back to top
View user's profile Send private message
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Mon Jul 17, 2006 6:24 pm    Post subject: Reply with quote

thanx for the info haggar; I hate it when programs leave that kind of trash behind Evil or Very Mad Stupid @!#$%^&
It eats up HDD & Mem-space, slows down your system and could even corrupt your Windows in the end Confused
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Mon Jul 17, 2006 6:26 pm    Post subject: Reply with quote

yes EBFE fixed it all... no more referenced to Bad 0015xxxx sections hehe... i just skipped past it all like you did Smile you can reach OEP by Break on access easy aswell..but its hammered..but i just restored the bytes.. from a Running .exe i dumped... but its alot more then OEP it forgets to fix Smile hehe
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
haggar
Regular
Regular


Joined: 19 Mar 2005
Posts: 246

PostPosted: Mon Jul 17, 2006 7:14 pm    Post subject: Reply with quote

Ok than Cool


Btw , I forgot to thanks bengunn for apropriate target - thanks.
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Mon Jul 17, 2006 8:33 pm    Post subject: Reply with quote

ya im wondering, in begguns case.. the target he talks about my trial is experied... and button is gone... looking for a way to renable... if you know of a easy way let me know Wink trying my luck atm thou , also its should be VTprotect... just names i find in the files.... seems apropriate to mention
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
haggar
Regular
Regular


Joined: 19 Mar 2005
Posts: 246

PostPosted: Tue Jul 18, 2006 8:41 am    Post subject: Reply with quote

Quote:
It also writes key in registry with embedded nulls. Use RegDellNul from sysinternals to remove it.


Cool
Back to top
View user's profile Send private message
Soul12
Occasional Poster
Occasional Poster


Joined: 17 Apr 2005
Posts: 39

PostPosted: Tue Jul 18, 2006 9:14 am    Post subject: Reply with quote

that will moste likely reset trial Smile...but theres also targets where the button is never there.... ive been looking for a way to activate it....but no luck..its a very long routine Sad
_________________
Once The Digital War Comes , Crackers Will rule the world
Back to top
View user's profile Send private message MSN Messenger
SKiLLa
Frequent poster
Frequent poster


Joined: 29 Mar 2005
Posts: 79

PostPosted: Wed Jul 19, 2006 8:53 am    Post subject: Reply with quote

Quote:
It also writes key in registry with embedded nulls. Use RegDellNul from sysinternals to remove it.


Actually it's RegDellNull from MS now; SysInternals & WinInternals have been bought by MS Wink But seriously, nice work on the info !
Back to top
View user's profile Send private message
haggar
Regular
Regular


Joined: 19 Mar 2005
Posts: 246

PostPosted: Wed Jul 19, 2006 10:00 am    Post subject: Reply with quote

SKiLLa wrote:
Quote:
It also writes key in registry with embedded nulls. Use RegDellNul from sysinternals to remove it.


Actually it's RegDellNull from MS now; SysInternals & WinInternals have been bought by MS Wink But seriously, nice work on the info !


What? You gota be kidding me! I'l check their site.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    www.reversing.be Forum Index -> Unpacking All times are GMT + 1 Hour
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group
 Copyright © 2019 BiW Reversing
 All trademarks and copyrights on this page are owned by their respective owners.
Powered By Geeklog 
Created this page in 0.05 seconds