Tweak XP Pro 3.04

OK... after analyzing the working IAT for v2.07 i found out that the missing one is DllFunctionCall ... i could be wrong .. but correct me anytime if i'm mistaken ... here are attached new dumped including added IAT + IAT tree for new and old version.

btw the app. still crash always at same offset ... i believe this most be a crc check

btw i used as OEP 0000137A to get the IAT for v3.0.4

[BetaMaster]

thanks Crk again, so nice of you to complete the job.
I appreciate it very much.

[BetaMaster]

ok, after some analysis it seems neither is correct, the added entry or the oep.

the missing entry is away from msvbvm60.dll, perhaps it's decryption routine, or some sort on code injection routine.

I think if the author of the product spent his time enhancing his product more than the time he spent to over-protect it, that would have been much much better for him.I cannot imagine that a little program to change some entries in registry, or do things that freeware program does, can have such protection.

this is right OEP and the way it should be... check more VB. app. and you'll know why

here it is some part of the code (P-Code) disasembled ... now it's possible to analyze the keyfile routine and possible to reverse without license

and here are all TweakXP Resources i got using VBReformer for knowledge and studies purposes only!

[BetaMaster]

look closely here at image2, I think you'll know that 401380 seems like a good oep; not 40137a.

and image1 shows that ordinal at 1094 is referencing memory below than usual in regards to visual basic interepretation; it's not in the usual memory 77xxxxxx areas.

@Crk, you are very good, but I want to show the facts.

look closely here at image2, I think you'll know that 401380 seems like a good oep; not 40137a.

sure.. but i never said 40137a was a good OEP .. i just used to get the IAT then i wrote back 401380 to Imprec wich Insert good OEP automatically .. or you can do it by hand/manually

since at the right place OEP should be only contain 909090.. data .. Imprec interprete this as invalid OEP .. but if you wrote as OEP where the last JMP API call is Imprec will read this place as valid OEP and will find almost all correct API jumps for IAT

[mtw]

Yes DLLFunctionCall is the function that will be missing from the IAT on a dump with imprec. Also it checks for special.dll that is also imulated by the wrapper, 1 function exported SVKP_KillDebugger, so if it doesnt find this it makes an error and exits. Last one to get into the code is the call to CryptVerifySignature, if you see that file in the main directory "tweak-xp3.val" this is a prehashed value from MS crypto that checks your dumped file, so make a dll with the SVKP_KillDebugger exported, when it loads and calls this just patch the call to CryptVerifySignature to return 1. Now you can run the app and look for the reg procedure. Also OEP 401364 "push 401A68", "Call ThunRTMain".