Is it possible to unpack ASProtect 1.23 RC4 Registered packing software?

BTW:Another program packed with "ASProtect 1.23 RC4 - 1.3.08.24 -> Alexey Solodovnikov",I have spent 5 days on fixing the tricks,but still unsuccessful.Anyone could help me?

Here is the packing target & unpacking target with fixing Stolen,IAT,OEP,but not the tricks.

i found this today
btw i was checking it and i got it full loaded but there are many check and tricks because it crash sometimes when opening the setting dialog and when is loaded ...i believe this is because and active hidden crc check that stop decrypting some parts of the code after it founds it was unpacked .. i removed all aspr. tricks .. but i guess that's not matter of aspr. any longer ...all aspr tricks and check you can find them from 005B3C70 ..maybe there are some others...

real OEP is: 001B4378 ( 005B4378 )

Stolen bytes: 558BEC535657B8183d5B00

To Crk: I think you are right!
BTW:Have you saw it?

Another program packed with "ASProtect 1.23 RC4 - 1.3.08.24 -> Alexey Solodovnikov",I have spent 5 days on fixing the tricks,but still unsuccessful

I can fix some tricks,now the problem of "file corrupted!" solved,it can full loaded,there is a Register dialog first,but all the command-buttons can't work normally except "Enter code" one.So,I think this must be the trick of the author maked.How to fix the trick,let all the buttons work normally,It is difficult I believe. I'll try my best to solved it.I'm glad if anyone would like to talking about it with me.

[britedream]

Hi Nemda2k3!,
I just looked at your dump to see if you cleared usual asprotect antidump, there are some you didn't clear , such as the checking of your entry point to see if it still the protector entry point , if not , the target is unpacked , and will give you a problem :

0047DFF3 8B35 18C75500 MOV ESI,DWORD PTR DS:[55C718]
0047DFF9 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]
0047DFFC 8B4430 28 MOV EAX,DWORD PTR DS:[EAX+ESI+28]
0047E000 66:3D 0010 CMP AX,1000
0047E004 74 04 JE SHORT dumped_f.0047E00A

here you can see it is loading the entry point from the target pe header and comparing with the protector entrypoint [rva].

follow the return and you will see also the next call isnot corrected, and so on.

britedream

i know someone which has unpacked and have full working exe of this .... but there are many sections of code encrypted..without key can't unlock some functions.... anyone has a key for private purpose to unlock the encrypted parts??

[britedream]

Hi crk!

here the code snippet where the target checks the registration flag, if you set this flag ,it should eliminate the nag and activiate the disabled options.

0047DFB8 833D 907F5500 0>CMP DWORD PTR DS:[557F90],0
0047DFBF 74 09 JE SHORT target.0047DFCA
0047DFC1 833D 8C7F5500 0>CMP DWORD PTR DS:[557F8C],0
0047DFC8 74 13 JE SHORT target.0047DFDD
0047DFCA 33C9 XOR ECX,ECX
0047DFCC B2 01 MOV DL,1
0047DFCE A1 44874000 MOV EAX,DWORD PTR DS:[408744]
0047DFD3 E8 80FEF8FF CALL target.0040DE58
0047DFD8 E8 8F61F8FF CALL target.0040416C
0047DFDD C3 RETN

the first cmpareson is for reg. flag, follow the value to dump and set the first byte to 1.
Regards.

Hi britedream,
You are right! I found myself really lacked of these knowledge.

I just looked at your dump to see if you cleared usual asprotect antidump, there are some you didn't clear , such as the checking of your entry point to see if it still the protector entry point

So,How can I improve myself .Could you give me some advices?

Regards
nimda2k3