Trouble with a VBox prot

[Naides]

Yes.

I am not completetely familiar with the rules of the board, so I will mention the app by name. please correct me if it is not proper.

The demo version of Photoshop CS (Not CS2) came packed with Vbox 4.3 Several of it plug-in files were Vboxed. The files had weird extensions .apl, but were in fact .dll in disguise. They had a valid PE format and IDA recognized them as .DLL and disassembled them.

There was no major problem in finding the OEP and dumping them, using Olly: I placed a BP on execution (Using a patched version of olly) to the whole .text segment.

Repairing the IAT was a harder problem, because IMPREC got lost while searching for imports. I had to reconstruct the IATs manually, which is a major pain.

So Vbox packed dll can be unpacked using near-standard methods

[D-Jester]

A simple search of this forum would reveal a tutorial on VBox and Photoshop that I wrote

http://forum.exetools.com/showthread.php?t=5953

VBox is old but always a great target for beginners