Request for EZCD x86 unpack Tutorial

[wilson bibe]

What the problem in crack an app commercial or not?. We are in a game only this, and I believe that the game never be die, it's a pleasure that I can't explain when the reverse is done. IMHO Don't desist @Benten, continue, You, me and all of us will always have something new to learn, e.reverse is this: learn,learn,learn...brain,brain,brain....and patience.
Greetings......

[giv]

Originally Posted by wilson bibe

e.reverse is this: learn,learn,learn...brain,brain,brain....and patience.

I will add here the term "and rehearsal".

Originally Posted by Benten

From the bottom of my heart, I am not interested in cracking some software. I am interested in learning the real thing like in the PDF, that's it.

Just watch my commands in the unpack script and you will know when, why and what you must do to unpack a Armadillo file. And is there the IAT elimination feature present. IAT scrambling is import redirection - imports are in the import table but they are redirected and their names are not visible and you need to reconstruct their names - and IAT elimination is that imports table is scattered all over the file and you need to gather and put in one place. Just step command by command and you will see the magic reveal. You do not need any tutorial when a script is available. Just trace command by command and you will see live the things happening. Then you will conclude by yourself. All protectors do the same thing. Encapsulate the protected file into their own shell and try to fool the debugger by hiding the OEP and parts of the code or redirect or rebase some imports or resources. Just the method is different on each protector.

[Benten]

Hi there,

@GIV
Sorry to bother, but would you post a link for the script please, I am still at Rept. 2 can't download attachments (I thought the restriction's for Rept. < -10, whatever).

@wilson bibe
Bro just ask me about the commercial app thing, some still call me a pirate for that.
What did I do now? Am I supposed to believe, the people who ask help on crack mes never tries that on commercial app. Everyone's doing it behind the crack mes, and my mistake is what? not being creepy, pffff...

It seems, these days its rather easy to get away with lies, cheating and faking but the whole world will punish you if you take the straight road.

Anyway lets just focus on the target.

[TechLord]

Originally Posted by wilson bibe

What the problem in crack an app commercial or not?. ......

I just think that its better that when topics of bypassing protections in a commercial app are discussed, its better to do so in private sub-sections of the forum rather than in a thread thats visible to everyone on the internet including non-members of the forum.

If I google "Armadillo unpacking 9.64" , this thead is shown among the top 5 hits.

Nothing wrong @Wilson Bibe - till the author of the author decides to sue you for the damages, if they can trace out your "real" identity.That's why I say that these things should be done privately ...

I hope that this thread can be moved to a private sub-section of the forum. Thats all

P.S : Just to avoid any members saying that I am unable to recover the scrambled imports, I'd posted that screenshot showing that was able to recover all the imports without issues.

No super-powers needed for that

[Benten]

@TechLord:

Did you do the "Junk Marking", to see the decrypted code and disable emulation or is there an easy way?

I get to see where the Security.Dll (I think its the security dll, cause if I disable the writes JE/alloc it will say can't allocate Dll error) is loaded, what loads it and stuff, also I got to see where the decrypted code gets written for the first time. But I couldn't find the second Junk marker. Still trying... and its frustrating..

Also I've tried using UIF, and my manual splicing fix still works, then attached the memory regions missing(like the one I believe is the Security Dll and the one with size 0E6000H) but the dump crashes. I thing I am missing the API redirection/emulation Fix. I wish I could put all of this in a video.

I wish I had 10 Rept., still can't get GIV script v0.2. Please share that attachment link if someone has it already.

[Update]
Got past the second Junk Marker its actually a Call that decrypts the code pages,

I believe I am at the Import Redirection itself, need help now.

Anything Seems familiar?

1. http://i.imgur.com/dgzYpm7g.png
2. http://i.imgur.com/F242Krhg.png
3. http://i.imgur.com/8WhNlCkg.png

So here is a video, check it out.. 
I am getting almost 740 api's but still can't get the dump working.

Video

Oh I missed it, the error I get is "Out of Memory"
Come on Guys, its about time, someone helped me...

Regards,
Ben

[Benten]

@TechLord,where you at I need help man... still waiting for that tut