Jump to OEP - Aspack 2.12

Hi,
I have seen this before. But I got pissed off trying inline patching 2.11c packed GetDataBack. I was able to successfully inline patch Captain Nemo by Runtime software and it's packed with this same version. The only problem is GetDataBack. I remember "hobgoblin" giving me some hints on inline patching this modified ASPack. But I was not able to do it. Then I used DZA patcher to patch it and it does patch it. But then the some buttons get corrupted and won't work.

But then coolfires tip is interesting

Here are the topics posted earlier:
http://exetools.com/forum/showthread.php?t=4072&highlight=ASPACK

My tutorial on inline patching ASPACK 2.11:
http://exetools.com/forum/showthread.php?t=3909

Download Captain Nemo:
http://runtime.org/captain.htm

Here is my patch for Captain Nemo:
http://iribtv.net/CCC/ARTEAM/cracks/captain_nemo.rar

You can apply my patch to the exe and then check in Olly.

REgards,

[TheDutchJewel]

Nice tut about finding the jump to OEP in aspack 2.11. This hardware breakpoint on ESP value method also works for v2.12.

The difference between v2.11 and v2.12 is that in v2.11 you can't find the signature bytes for the jump to OEP. It seems to me that the section for the signature bytes in v2.11 will be decrypted by the unpacking routine. (I see this is already explained here: http://exetools.com/forum/showthread.php?t=4072&highlight=ASPACK)

I downloaded GetDataBack for NTFS v2.25. When debugging I see this XOR code:

0063C516 3C A9 CMP AL,0A9
0063C518 338F 0A4FC73A XOR ECX,DWORD PTR DS:[EDI+3AC74F0A]

But after I put a breakpoint on it, Olly didn't break.
So if possible, upload the exe you used in your previous section and I'll try to inline patch it.
Or can someone explain how to break on the XOR code?

[hobgoblin]

To ferrari,
If you're still interested in inlinepatching of Aspack 2.12, take a look at the attached file. It's gdbnt from runtime.org. I have made an inline patch just to show how it can be done.( I made a patch that patches 3 bytes in the unpacked file. Don't pay too much attention to the patched program itself, it may not be properly cracked.). Just open the file in Olly and put a bpx at 0066B573. This is right after the xor-based decryption is done. Just singlestep from there and see what happens and where..

regards,
hobgoblin

[TheDutchJewel]

ferrari,

Use this unpatched exe for v2.25.

change:
0063C4B2 E9 14000000 JMP gdbnt.0063C4CB

into

0063C4B2 E9 5D140000 JMP gdbnt.0063D914

and add here your inline patch bytes:

0063D914 66:C705 63874F00 EB23 MOV WORD PTR DS:[4F8763],23EB
0063D91D 68 CBC46300 PUSH gdbnt.0063C4CB
0063D922 C3 RETN

I used your patch info at the address you used. The attached exe is different from the one you used, so you should correct the address and bytes at 0063D914.

[hobgoblin]

Hi Dutchjewel,
Are you sure your solution in the previous post works? If you follow your described method, the code written to
0063D914 C705 63874F00 EB230000 MOV DWORD PTR DS:[4F8763],23EB
0063D91E 68 CBC46300 PUSH gdbnt.0063C4CB
0063D923 C3 RETN
(after jumping from 0063C4B2) will be overwritten later on...

hobgoblin

[TheDutchJewel]

Hi hobgoblin,

No I didn't check it. I simply used the patch bytes from ferrari in this example. I think the address 4F8763 should be changed for this version, but that's for ferrari. Anyway, the principle of inline patching should be good.

[hobgoblin]

I agree that the basic idea you're outlining will work.(I have done a similar thing in my patch).
But I think using the address at 0063C4B2 is too early. When you arrive at that code (location) the program isn't properly unpacked yet, and that the unpacking process that follows this jump will overwrite what you previously have patched. In my patch I used the first jump after the decryption is done, and that works (as a starting point for further patching/redirection).

regards,