Posted: Sat Jul 15, 2006 6:31 pm Post subject: Elicense/Vprotect unpacking
ive been working on : hxxp://www.ootpbaseball2006.com/
ive unpacked it..found OEP...restored IAT...but yet it fails to run correct.. and im clueless...ive been figthing with it for hours...so if anybody wanna look.. plz do so ive added my "unpacked" files
I was thinking to try it, but game is too big for dial-up. Do you know some smaller target ~2-3 MB?
Load your unpacked files in Olly, uncheck exceptions and find where it crushing. After it stops on exception, check stack - maybe address in stack is some call that tries to read empty address.
Search for all intermodular calls and check does it have empty ones, wrong , etc...
I'm not sure what he means by vprotect unpacking, the only elicen40 target I ever saw was some virtual destop app called Winspace, but that was in nov 2004 so I don't know if it still has the same protection. Don't remember any particular problems with it, maybe thats where the vprotect? comes in :shrugs:. I'm pretty sure its the same app as this 4.3mb d/l.
thnx 2 hagger for finding my error... when Program is loaded in a debugger its never Decrypts the .exe Completely..and leaves not only OEP but Large parts of the Program broken... and ive never seen this before... thnx 2 hagger! _________________ Once The Digital War Comes , Crackers Will rule the world
I have no idea why OEP bytes are changed, I didn't go too much into it.
Soul, did you done it with changing that OEP jump to EB FE? Is code section OK now?
Also , be sure that you dump with reeading PE header from disk in both ImpREc and LordPE. eLicense screw PE header. You could fix it manually, but why bother. Check does all imports are ok. Then find where file is crushing.
It installs tree files into rooth folder
and one in temp folder which is registration dialog program.
It also writes key in registry with embedded nulls. Use RegDellNul from sysinternals to remove it. After deinstalling target, all files stay on hard drive and they are set to run at windows start. They could at least remove those files.
yes EBFE fixed it all... no more referenced to Bad 0015xxxx sections hehe... i just skipped past it all like you did you can reach OEP by Break on access easy aswell..but its hammered..but i just restored the bytes.. from a Running .exe i dumped... but its alot more then OEP it forgets to fix hehe _________________ Once The Digital War Comes , Crackers Will rule the world
ya im wondering, in begguns case.. the target he talks about my trial is experied... and button is gone... looking for a way to renable... if you know of a easy way let me know trying my luck atm thou , also its should be VTprotect... just names i find in the files.... seems apropriate to mention _________________ Once The Digital War Comes , Crackers Will rule the world
that will moste likely reset trial ...but theres also targets where the button is never there.... ive been looking for a way to activate it....but no luck..its a very long routine _________________ Once The Digital War Comes , Crackers Will rule the world
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum