Tried unpacking DVDIdle Pro - AsProtect

After we run the trace and patch the stolen bytes and reset OEP...

When we go to dump the file, is there a way to also store the memory contents of 960000 thru 990000 so that they are reloaded in the same location when the "unpacked" program starts up?

Back in the day we could save the memory and dump it to a binary file...then you could reload it back into the same memory location from the file at any time you wanted. Is there a way to do this now?

-Malt

[britedream]

exactly , yes, in dumped file itself we can patch to read back all the region you want , just choose the region you want,save as binary, then read it back, of course you have to allocate the space for each region using virtualAllloc.

[britedream]

the error you refer to by xoring mov eax,...., is due to a refrence to region 970000"imagebase", 973861"Va" , which isnot there any more, if you aren't registered then eax==0, this is why it is running ok in your case, if it were to return other value for unregistered, then I would think it will effect the target.

[Kyrios]

there are 2 encrypted fragments in the dumped file. If it wasn't decrypted yes, it can't be FULLY working version.
Is there any way to decrypt without having to register? IF there was a blacky serial, how can we do with it?


TIA,
kyrios

[MaRKuS-DJM]

Originally Posted by Kyrios

Is there any way to decrypt without having to register? IF there was a blacky serial, how can we do with it?

maybe you can use asload and let it run registered. You can debug it, set BP on CreateProcess and then debug the program while asload does his register-job and then dump the program fully registered & decrypted

[Kyrios]

maybe you can use asload and let it run registered

No, i wanna know how to do it by hand. Afterall, i've tried several ASPRed programs, but always fails. Pstrip, elcor, and articons for instance.

BR,
kyrios

[MaRKuS-DJM]

powerstrip uses some heavy checks... it's not so easy. i don't know where these checks are located