Tried unpacking DVDIdle Pro - AsProtect

[britedream]

0041EFE6 55 PUSH EBP
0041EFE7 8BEC MOV EBP,ESP
0041EFE9 6A FF PUSH -1
0041EFEB 68 A05F4200 PUSH DVDIdleP.00425FA0
0041EFF0 68 40EF4100 PUSH DVDIdleP.0041EF40 ; JMP to MSVCRT._except_handler3
0041EFF5 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0041EFFB 50 PUSH EAX
0041EFFC 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
0041F003 83EC 68 SUB ESP,68
0041F006 53 PUSH EBX
0041F007 56 PUSH ESI
0041F008 57 PUSH EDI
0041F009 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
0041F00C 33DB XOR EBX,EBX
0041F00E 895D FC MOV DWORD PTR SS:[EBP-4],EBX
0041F011 6A 02 PUSH 2

this is the correct stolen.

[britedream]

for the stack everything follow my tut. except 12ffbc == 00000000 instead of ffffffff, but if you folllow the code ,it was there but just over written by:
mov dword ptr ss:[ebp-4],ebx; the ebp== 12ffc0 if you substract 4 from it, you will end up at 12ffbc, where ebx with value of 0 moved to it.

learn to use the stack with the trace, not the trace alone.

sorry I relied on lownoise first finding and it was wrong.

Hmm, lots of imports the aspr2 plugin can't handle on this one...

Thank You both Lownoise & Britedream.

So now I understand why the PEiD shows compiler. I must see how a normal program compiled with that particular brand compiler has it's startup code. Got it.

Since there is nothing in the "K" (STACK) window, I do not need a JMP I just fill in the 45 blank "00" bytes with the stolen bytes. Got it.

I apologize...when I learned to crack on the Apple ][e (Don't laugh... I know you are ) *Hey my Algebra teacher got me started. A Push was a push. After looking at another tutorial I saw that MOV DWORD PTR SS:[ESP+number],EBP is the same as PUSH EBP. This is my failure. Now I know.

Thank you everyone for your patience... and willingness to help.

I am using Imprec now. I tried setting size to 1000 and only found 2 instances where dissasemble/hex said no data. I have to go to work... I look at it with Imprec later today after work.

I'll share with you what I find out.

Thanks again everyone!

-Malt

[britedream]

To svensk

the target runs on this iat:
there are only two exceptions, if you fix the first one you are registered, the second is to correct the stack.(I haven't test the program but it runs fine).

Ok, I'll check it out and thanks for the nice scripts for OllyScript btw. Saves alot of time

[britedream]

my pleasure!,

Some time it is usefull to use my script "asprsto", it will stop where we should be looking in the stack, that is 12ffc4:77e814c7(for this program), F9 few times till you are at mov ebp,esp; then follow the execution of your stolen with F8.

Nice stuff, I followed the stolen bytes during execution with your method.
Still having problems with my dumped exe though. After the trace I end up at:

0041F013 FF15 68274200 CALL DWORD PTR DS:[422768] ; MSVCRT.__set_app_type

I insert the stolen bytes and change the origin to PUSH EBP at 41EFE6 and then dump the exe with OllyDump, unchecking Rebuild Import. I load your tree in ImpRec and press Fix Dump. I load the exe in LordPE and change OEP to 1EFE6. Problem is the exe still wont run.

It crashes at: 0041F115 |. E8 F6020000 CALL dumpLord.0041F410