Request for EZCD x86 unpack Tutorial

[abhi93696]

NO.... You are ABSOLUTELY WRONG!!

Again you posted your post EVEN without properly seeing the above posts & WITHOUT even Seeing the target!! You even didn't bothered to read the Benten posts properly & even failed to understand his post's meaning properly....

Originally Posted by TechLord

The target is v7.0 of Armadillo whereas the script is [targetted] for v9.64...
There are significant differences between the 2 versions in my experience (while I agree that there are also similarities)..

That's NOT true... If you have really tested the target or even bothered to read this post properly then you would came to know the truth...

By writing

Here is my target, (This one is an old old version (the latest is v7.X.X)).

Benten meant that "His" target's latest version is v7.0 NOT of Armadillo's... That's why he also posted the pic (because some members don't read the posts properly) -:

AKT Version Details:
https://imgur.com/ppy3Za9

Also i have also tested the target -: https://imgur.com/a/2av70
So in the pic v9.4 means version 9.4 of armadillo , So how does it become v7.0 of armadillo? Please Explain?

Anyway I really commend that you AT LEAST read some part of the post correctly . I do know that he doesn't need scripts & tools, thats why I in VERY first line wrote -:

Not sure if it helps you! But nothing bad in trying

But you didn't even read it Also i posted the script cuz script simply means doing automated work...So one could read the script & understand what's going on...

IN Summary-:

• Always first read & understand the posts PROPERLY.
• Don't be in hurry to write the posts Without even thinking.
• Our friend Benten & other people would have much more appreciated your post instead of posting this , you would have post teh TUT .. Afterall you say you are experienced one & knows the differences & similarities between v7.0 & v9.64 of armadillo

So it can be CLEARLY SEEN that either don't properly know & understand English or you don't bother to read the posts properly or you just use to baffle people!!
Anyway I appreciate your efforts that you wanted to help others

Cheers

[Benten]

Guys, first let me thank you guys for the comments.

I see there is a lot of confusion going around but first off, let me thank @ TechLord properly,

Man thank you so much, I've been waiting for someone to understand what I am trying to do. I was about leave this stupid forum thing. But since you seem to get the idea I am posting my previous efforts here,

1. Armadillo Minimal protection + Splices (Full Manual no tools except Scylla)

Notes: Here in first video, you may choose a different section there is an Armadillo section with size 10,000. Choosing .BSS is not good its a mistake, and it makes the dump huge(275MB). But choosing .yvjtgm or .pbscxm (Haven't tried it) makes the dump really smaller (23.6MB)

2. Armadillo Debug Blocker (Full Manual no tools except Scylla)

@abhi93696: thanks for clearing that up, I mean the latest version of the target is v7.x, and the one I've attached is an old version v3.1.5. But all of these targets uses Armadillo 9.64 Custom.

There is a tutorial by FFF on this Target version 3.1.0 i believe, but its x64. There is no encryption in x64 so that tut is not useful.

And about the GIV script, it's is for OllyDbg and that's another reason why I want to do this tut manually. You see most of the scripts are platform/tool dependent. I know what pattern is he searching for, but that script does not work in x64Dbg. I choose it cause its a new tool.

We have made a habit of using tools and it has ruined us beyond repair. Its too late now but still someone has to try and preserve the old art. I know I can't do much here but I am contributing what ever I can.

I hope someone needs to take my request seriously and do something about it.

Regards,
Ben

[TechLord]

Originally Posted by Benten

Guys, first let me thank you guys for the comments.

I see there is a lot of confusion going around but first off, let me thank @ TechLord properly,

Man thank you so much, I've been waiting for someone to understand what I am trying to do. I was about leave this stupid forum thing. But since you seem to get the idea I am posting my previous efforts here,
...

You are WELCOME my friend

Originally Posted by Benten

There is a tutorial by FFF on this Target version 3.1.0 i believe, but its x64. There is no encryption in x64 so that tut is not useful.

And about the GIV script, it's is for OllyDbg and that's another reason why I want to do this tut manually. You see most of the scripts are platform/tool dependent. I know what pattern is he searching for, but that script does not work in x64Dbg. I choose it cause its a new tool.

We have made a habit of using tools and it has ruined us beyond repair. Its too late now but still someone has to try and preserve the old art. I know I can't do much here but I am contributing what ever I can.

Yes I am aware of GIV's script+dll - Its quite a wonderful thing and I'd used it many a time, but in THIS situation, it would not be of much help, as you'd said already above
That was the reason why I highlighted it above...

Yes, I FULLY agree with you that doing it the manual way makes us actually LEARN

Btw, as you can see a couple of posts above this, I made a post first and then deleted it yesterday, as I initially wanted to put up a VERY quick tut but later decided that I wanted to make it a bit more polished before actually uploading it.

The next few days I am a bit busy but I hope to put up a TUT (if by then our GURUs and EXPERTS like Mr Exodia, Tonyweb and others have not already solved it )

Good luck

[abhi93696]

Originally Posted by TechLord

Btw, as you can see a couple of posts above this, I made a post first and then deleted it yesterday, as I initially wanted to put up a VERY quick tut but later decided that I wanted to make it a bit more polished before actually uploading it.

Ohh...So you had already made a tut for a software whose protection version you didn't know till now! Nice Superpowers you have! Cool


Anyway its nice to see that you are going to make a POLISHED TUT Looking forward to it...

Br

[TechLord]

Originally Posted by abhi93696

Ohh...So you had already made a tut for a software whose protection version you didn't know till now! Nice Superpowers you have! Cool
Br

This thread is visible to everyone on the internet and not just to registered members of the forum, and is also indexed by various search engines.

So I thought it prudent to use a protected CRACKME to illustrate the recovery of imports which had been eliminated/scrambled as that was all that Benten wanted to know.

Also, just for the record, there's not too great a change in the implementation of Import Elimination/Scrambling between those 2 Armadillo versions.

Cheers