Is it possible to unpack ASProtect 1.23 RC4 Registered packing software?

To Crk: I think you are right!
BTW:Have you saw it?

Another program packed with "ASProtect 1.23 RC4 - 1.3.08.24 -> Alexey Solodovnikov",I have spent 5 days on fixing the tricks,but still unsuccessful

I can fix some tricks,now the problem of "file corrupted!" solved,it can full loaded,there is a Register dialog first,but all the command-buttons can't work normally except "Enter code" one.So,I think this must be the trick of the author maked.How to fix the trick,let all the buttons work normally,It is difficult I believe. I'll try my best to solved it.I'm glad if anyone would like to talking about it with me.

[britedream]

Hi Nemda2k3!,
I just looked at your dump to see if you cleared usual asprotect antidump, there are some you didn't clear , such as the checking of your entry point to see if it still the protector entry point , if not , the target is unpacked , and will give you a problem :

0047DFF3 8B35 18C75500 MOV ESI,DWORD PTR DS:[55C718]
0047DFF9 8B46 3C MOV EAX,DWORD PTR DS:[ESI+3C]
0047DFFC 8B4430 28 MOV EAX,DWORD PTR DS:[EAX+ESI+28]
0047E000 66:3D 0010 CMP AX,1000
0047E004 74 04 JE SHORT dumped_f.0047E00A

here you can see it is loading the entry point from the target pe header and comparing with the protector entrypoint [rva].

follow the return and you will see also the next call isnot corrected, and so on.

britedream

i know someone which has unpacked and have full working exe of this .... but there are many sections of code encrypted..without key can't unlock some functions.... anyone has a key for private purpose to unlock the encrypted parts??

[britedream]

Hi crk!

here the code snippet where the target checks the registration flag, if you set this flag ,it should eliminate the nag and activiate the disabled options.

0047DFB8 833D 907F5500 0>CMP DWORD PTR DS:[557F90],0
0047DFBF 74 09 JE SHORT target.0047DFCA
0047DFC1 833D 8C7F5500 0>CMP DWORD PTR DS:[557F8C],0
0047DFC8 74 13 JE SHORT target.0047DFDD
0047DFCA 33C9 XOR ECX,ECX
0047DFCC B2 01 MOV DL,1
0047DFCE A1 44874000 MOV EAX,DWORD PTR DS:[408744]
0047DFD3 E8 80FEF8FF CALL target.0040DE58
0047DFD8 E8 8F61F8FF CALL target.0040416C
0047DFDD C3 RETN

the first cmpareson is for reg. flag, follow the value to dump and set the first byte to 1.
Regards.

Hi britedream,
You are right! I found myself really lacked of these knowledge.

I just looked at your dump to see if you cleared usual asprotect antidump, there are some you didn't clear , such as the checking of your entry point to see if it still the protector entry point

So,How can I improve myself .Could you give me some advices?

Regards
nimda2k3

[Michel]

To Crk :

...without key can't unlock some functions....

Removing all aspr tricks seems to be a Great-Art....
For all those (like me) who aren't so Great-Artist, it's more easy to merge the requested aspr sections at the dumped. Then this last will never crash (but of course works only on the machine where the dump was done, and with the dlls versions used ).

If you really want tu use the prog, don't forget AsLoad, wich works fine with all aspr 1.23 RC4 I have tryed....