Armadillo DLL unpacked but...

[taos]

Originally Posted by t4d

Eltima guys use GetEnvironmentVariableW

ALTUSERNAME
DAYSLEFT
EXPIRED

which are fired by ArmAccess.DLL

If not catched than bye, bye. Check this.

BTW. Your DLL cannot be registered on my system. Maybe some relocation problem. Do you use RELOX to finish your job on dynamic libs ?

Hi!
First thing is: THANK YOU TO ALL.

The job is done now

t4d gave me the right tip. I had to crack some bytes in DLL to bypass ArmAccess.DLL.
So unpack was succesfully and now has been cracked too.

Thanks to ALL again for your help.

Info:
Open an exe loader that uses this DLL/OCX in Olly.
bp GetEnvironmentVariableW
When breaks press F8 until you be in main.exe
Press CTRl+F9. Press F8 again only one time.
You have to change this jmp:
10013CEA JNE SHORT 10013CF2 to JE or JMP
and this too:
10013CFD JNE 10013D98 to JE or JMP


Did it!