|
|
|
|
#1
06-12-2004, 19:57
|
|||
|
|||
|
Version has changed
the version has changed to 5.0.2.6, two versions changed in one day, they must be reading this forum. our patch will not work on the new version.
it is no longer protected with new asprotect 1.31, it went back to the old one Last edited by britedream; 06-12-2004 at 21:27. 
|
|
#2
06-13-2004, 06:44
|
|||
|
|||
|
just so you know, i was using 5.0.1.6. but here's a little crash report:
Quote:
 if they went back to the older aspr, that's a good thing for them and their customers. i don't like the way the new aspr runs (which is too slow). programmers who use these protections should always opt for speed cuz even when they use these 'advanced' options it doesn't make it unbreakable for those of us who know the ways around this stuff. if they opt for a slower more heavily protected app you should expect complaints from your customers about sluggish performance. just my 2 cents. Last edited by bollygud; 06-13-2004 at 06:51.
|
|
#3
06-13-2004, 09:34
|
|||
|
|||
|
Thanks for the info
But the call you refer to at address 476fdc is call LoadLibraryA, and it is called the way it should be but I don't know why isnot working on w2k.please try to change it to Call LoadLibraryA, and at address 476fe6 is call GetProcAddress, change these two, and see if it works for you.
|
|
#4
06-13-2004, 11:15
|
|||
|
|||
|
luckily this app incorporates both of those api into its starting imports.
here is some fixed code for this routine: Quote:
nice approach
|
|
#5
06-13-2004, 11:31
|
|||
|
|||
|
I did code it on the xp as call LoadLibraryA and call GetProcAddress, I don't understand why it isnot working on w2k. it is working on my xp. I think mapping these calls are different on w2k.
|
|
#6
06-13-2004, 11:52
|
|||
|
|||
|
Quote:
|
|
#7
06-13-2004, 12:06
|
|||
|
|||
|
yes, i realise that these are standard api's incorporated into aspr'd apps
the reason that your call isn't working is cuz it's pointing directly to an address that simply doesn't exist in win2k. perhaps your kernel32 (or all xp kernel32) is based at 77000000. where mine is based at 7C000000. this isn't a new concept and is the entire reason for the need of an import table and iat. cuz with each system or OS, the api simply do not reside in the same exact address. it seems that since you have the grasp of all these things, and i doubt i need to tell you this. but just in case you didn't know... perhaps the fact that i copy/pasted from olly in haste that is shows the api names is confusing. but if you look what i really did was change the direct calls to indirect calls like so: Quote:
well... it was working, now i get a crc error (aspr virus error) coming from your hack file. strange cuz it was working. o well. Last edited by bollygud; 06-13-2004 at 12:33.
|
|
#8
06-13-2004, 12:26
|
|||
|
|||
|
sorry, but you didnot understand my point , I didnot call the address directly I used call LoadLibraryA, and patched through ollydbg, I understand where the kernel base is,but my point is that calling LoadLibraryA should be resolved by w2k, and it didn't.(thanks for your clarification).
Last edited by britedream; 06-13-2004 at 13:53.
|
|
#9
06-13-2004, 13:28
|
|||
|
|||
|
Quote:
|
 |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Hacking a VB-Prog | mr Xor | General Discussion | 4 | 02-17-2004 18:38 |
Hybrid Mode
