asprotect script

[Shub-Nigurrath]

exactly, the messagebox is part of the application and the OEP is reached in the way stephenteh told.
That application is anyway an interesting target..

[britedream]

very strange target, the target is loaded in high memory, this is why I thought it is still in asprotect when the nag shows and never stopped on default range of an exe [400000+codeoffset+codesize].

u shouldn't use fixed imagebase 400000, because this program loaded at location 4190000....u should use gmi to get the modulebase....

[britedream]

gmi has a problem with some asprotect target,you could do this :

mov pe1,eip
and pe1,ff0000
cmp pe1,400000
je go2
mov pe1,eip
and pe1,ffff0000

go2:
mov pe,pe1+[pe1+3c]

cmp pe1,[pe+34 ] // check to see if the imagebase you assumed is the right one.
je go
msg "wrong imagebase"
ret
go:

mov codes ,[pe+100]
mov codeb ,pe1+[pe+104]

but the target doesn't conform to main coding of the script, it isnot worth it to have a major change in the script for one odd target , if there are few of those , then I will update the script with their pattern. Thanks.
by the way, the imagebase of 400000 is the default where exe is usually loaded.we also can go to the extreme and for sure find the exact image base, but it will be long and isnot worth it. easy, if the imagebase is wrong ,just enter it manually.