Need help with Crunch/PE 3.0.0.x 4.0.0.x >Bitarts
 

Hello i have a question about this protection.
I have a proggie called Driver guide Toolkit that has this protection i have scanned with Stud-PE i couldn`t find a proggie for unpacking this protection.I have also searched here on the forum but i could not find a direct answer (mabye i overlooked it )

But can someone tell me how to unpack this proggie ,and for you info i am learning newbie guys so please not too difficult with explainning ;)

Thanks in advance.

ysco.

Re: Need help with Crunch/PE 3.0.0.x 4.0.0.x >Bitarts
 

do you mean from here ---> hxxp://www.driverguidetoolkit.com/

Yep thats the site lonewolf55 have you any info about it ????

Thanks.

ysco.

Ok I just downed the progie "dgt.exe" and then I right clicked on it and selected "extract files" ... ... I have winrar installed on win 2K .... it extracted the files to the directory dgt..

then I used "installshield cabinet file viewer version 6.21" and this allows me to start inspection....

I have not gone any further than this yet :D

I have looked for that proggie you mention on google but couldn`t find a valid link.
Will also look if it is on ftp here.
But what does the proggie, can you also dissambler/debugger the exe file or can you only view the file ,because if that is the only thing then we still have the problem that it is packed .

ysco.

well I'm not sure the progie I used will help any at all, it was just something I used just to get a general look at the installation method and allow me to get an idea of how to approach reversing

this tool won't reverse or modify any exe file, just for partial inspection :D

I don't remember where I found it it says DL'ed from playtoys but I think not where I found..........

anyway I do not see it here so I will atatch....

scanned no bugs found ----->

next thing you might wish to do is de-compile the "setup.inx" script file :D

find a progie called "sid.zip"

quote from readme:

[sid] - installshield 6/7 script decompiler
v1.0 written by sn00pee

introduction
------------
sid is designed to decompile installshield .inx scripts created with
installshield 6 or 7. additionally it allows the user to take a few
changes to the code and patch the script.

END quote

I found this file at protools.com

Thanks for the help buddy will try it again ;)

Hmm i have checked it just right now and if i look at the setup.inx and try too load it with sid then it says ((no valid installshield 6 file))

Do i something wrong ????

ysco.

?
 

ysco,
check your pm, the dll's in the cab file can be extracted with winrar or am I missing something?.

well, I hope it helps, it may not be the correct way to reverse this progie but I'm sure it can be done this way....

being I'm a stubborn old goat, I like to attack the setup methods first before I try to un-fuuk the installed apps lol

if anyone else have ideas please post, I'm learning too :D

Re: ?
 

was no mention of extracting dll's from cab file with winrar

what are you trying to do
 

I'm not sure what it is you are trying to with script decompilers, the exe is packed with crunch, as far as I can see that is what ysco wanted to unpack.

Re: what are you trying to do
 

what I was looking at was the actual installer, not the program after the installer had installed it.

edit:
after decompiling the setup.inx script I was looking at code such as this ---->

begin
/* 0000561C: 0022 */ // -- Begin Function Code -- //
/* 00005625: 0006 */ s0000 = g_str0008;
/* 0000562F: 0021 */ function_011C(0x00000001, s0000);
/* 0000563D: 0021 */ function_00ED("PRODUCT_KEY");
/* 00005651: 0006 */ s0001 = LAST_RESULT;
/* 0000565B: 0014 */ s0001 = s0000 ^ s0001;
/* 00005668: 0021 */ function_011C(0x00000002, s0001);
/* 00005676: 0024 */ return;
/* 0000567A: 0026 */ // -- Create Local Variables -- //
end;

oh, carry on then :)
 

still can't see how that relates to
seem to have out lines crossed somewhere, guess I'll butt out.

Re: oh, carry on then :)
 

no problems .. please if you can help please post more .. as I said I'm learning also :D

Jay check your pm ;)

Yes I want indeed unpack this crunch shit so that i can look further how too get this proggie cracked or regged :D

Thanks for all help.

ysco.

see your pm again
 

hope it helps

What he *WANTS* is for people to crack the Application for him, because he cant do it himself.

Anyways here is some Info's

OEP.........: 00404944
IAT BEGIN.: 00401000
IAT END....: 00401350
RVA..........: 00001000
LENGTH.....: 00000350

U can Dump By using Olly, Just Remove all Exceptions from the Ignore List, and about the 3rd Execption goto the OEP and Change it to a INT3, u will break there and u can dump and rebuild i guess.

Didnt try it, but it sounds like a plan.

-Peter

innocent until proven guilty
 

Oh man I'm so tired of reading these kind of comments and the "I can do it if you can't then you are either lazy or stupid" attitude. I suspect what he (and most newbies) want is to be able to request help without fear of ridicule or accusations from people such as yourself, with the number of posts he has I think he could find his way to the request section if he simply wanted it cracked. You gave good accurate info why not leave out the comments?. Best regards to wendy btw and *don't* grow up

Ahhh Jay,
I see now, what I was doing was taking apart the entire installer as it was downloaded ... I hadn't even ran the program to let it actually install.

lots of times I see protection in the installer itself, in this case that isn't true.

guess I'll look at making a small script for procdump, I think that could be possible.

procdump will not dump with what it has right now :D

I went and read quite a few tuts on crunch reversing that might help me with making a script for procdump :D

for just nailing the 8 digit key would brute force be viable ? after all it's only 8 numeric digits, I slammed 'bout 10 to it and it didn't crash like after 3 bad attempts ?

Note: as far as this program goes I could care less about it, I just saw ysco wanted some help, so I was just doing my best to help, with my limited knowledge......

Jay sorry about what u feel but one simple sentence he wrote confirms what i said.

"Yes I want indeed unpack this crunch shit so that i can look further how too get this proggie cracked or regged "

Simple as that. Now i dont give a shit if he cracks it or not if somebody cracks it for him or not, iam just saying what i think he wanted.

But then again i forget this is Exetools forum and not RCE :) so whatever.

Peter[Pan] you better grow up and read more carefully your behave as a child.

As Jay also mention if i wanna have it cracked by others (the easy way) then i had my thread put in the request section and not here.
What i ment in my last reply is like i explained before that i having problems with unpacking this crunch shit because this is the first time i have this protection,so if i manage to unpack it with the help off Jay then i can look further (meaning ) to see what other protections there are so that i can deal with it.But that only can if the exe is unpacked,you understand now what i am saying :mad: .

Anyway Jay thanks again for your pm ;)

ysco.