Jump to OEP - Aspack 2.12

[TheDutchJewel]

You've right. The first jump after decryption is done is 0063C55B? I checked now the jump to OEP, and it's decrypted well. Then ferrari should use that address instead of 0063C4B2, and push to 0063C467 instead of 0063C4CB.

regards

Hobgoblin,
A big thanks to you. I scanned the exe and well understood what you did I see that the author has updated the software and did not change the versiov no. i.e 2.31 The patch which I posted earlier is not applicable to this version. So I downloaded the program again and that matches the file you uploaded. I just did this to crack it fully
Changes:
004FA95E /75 00 JNZ SHORT _gdbnt.004FA960

004FA976 /75 00 |JNZ SHORT _gdbnt.004FA978

Still I need to practice on more such modified ASPack. The standard one is easy to inline patch. Thanks once again mate.

@Dutchjewel
Thanks for your attention to my problem buddy. I'm aware of that method you posted. You can see it in my tutorial. This ASPACked Getdataback is different to that. Anyways thanks

Regards,

Hobgoblin & Dutchjewel:

I was able to do it on my own. Thanks Hobgoblin


Changes:

1) 0066B573 - E9 284ED9FF JMP gdbnt.004003A0


2)
004003A0 66:C705 B6B36600 E916 MOV WORD PTR DS:[66B3B6],16E9
004003A9 66:C705 B8B36600 50D9 MOV WORD PTR DS:[66B3B8],0D950
004003B2 66:C705 BAB36600 FF90 MOV WORD PTR DS:[66B3BA],90FF
004003BB 66:C705 BCB36600 9000 MOV BYTE PTR DS:[66B3BC],90
004003C4 - E9 9EB02600 JMP gdbnt.0066B467
004003C9 0000 ADD BYTE PTR DS:[EAX],AL
004003CB 0000 ADD BYTE PTR DS:[EAX],AL
004003CD 0000 ADD BYTE PTR DS:[EAX],AL
004003CF 0000 ADD BYTE PTR DS:[EAX],AL
004003D1 C605 5FA94F00 00 MOV BYTE PTR DS:[4FA95F],0
004003D8 C605 77A94F00 00 MOV BYTE PTR DS:[4FA977],0
004003DF - E9 08AF1700 JMP gdbnt.0057B2EC<------------Jump to OEP

It works perfect

Regards,

[TheDutchJewel]

Hobgoblin,

Just want to let you know that your way of jumping to free space at the beginning of the file, add bytes to modify the jnz to jump to the patch bytes, and then jumping back to jump to OEP works great.

Thanks for this very helpfull way of teaching.

Regards,

[hobgoblin]

Nice to be able to help.
I use this method quite often when I crack some packed proggies for fun. I prefer this method because often you have to patch more than 1 or 2 bytes, and then you need more space than you get when you utilize code that's not executed. Although, sometimes the hunt for finding code that's not executed which can be overwritten without risk can be quite entertaining. And even more: if you start using this method on upx packed proggies, you have to take into account what space are protected and what space are not.
Well, enough said.....

regards,
hobgoblin