Tried unpacking DVDIdle Pro - AsProtect

[britedream]

exactly , yes, in dumped file itself we can patch to read back all the region you want , just choose the region you want,save as binary, then read it back, of course you have to allocate the space for each region using virtualAllloc.

[britedream]

the error you refer to by xoring mov eax,...., is due to a refrence to region 970000"imagebase", 973861"Va" , which isnot there any more, if you aren't registered then eax==0, this is why it is running ok in your case, if it were to return other value for unregistered, then I would think it will effect the target.

[Kyrios]

there are 2 encrypted fragments in the dumped file. If it wasn't decrypted yes, it can't be FULLY working version.
Is there any way to decrypt without having to register? IF there was a blacky serial, how can we do with it?


TIA,
kyrios

[MaRKuS-DJM]

Originally Posted by Kyrios

Is there any way to decrypt without having to register? IF there was a blacky serial, how can we do with it?

maybe you can use asload and let it run registered. You can debug it, set BP on CreateProcess and then debug the program while asload does his register-job and then dump the program fully registered & decrypted

[Kyrios]

maybe you can use asload and let it run registered

No, i wanna know how to do it by hand. Afterall, i've tried several ASPRed programs, but always fails. Pstrip, elcor, and articons for instance.

BR,
kyrios

[MaRKuS-DJM]

powerstrip uses some heavy checks... it's not so easy. i don't know where these checks are located

La La La La La La..... tracing into AsProtect code... watching it load, erase, load, erase code.... getting closer... will report when I get to the serial# code

-Malt

Hi!

Nah... Pstrip is not so very difficult... Look at the dips... there's a very useful clue! (Not THE solution, just a VERY important clue...)
And then you run it in olly and when it gives an exception (NOT the OEEDFEED) you examine that code, get to understand it and patch it.
This piece of code that throws the exception is quite common in aspr-targets...

/Manko

Originally Posted by MaRKuS-DJM

powerstrip uses some heavy checks... it's not so easy. i don't know where these checks are located