Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   svkp (https://forum.exetools.com/showthread.php?t=13408)

infern0 04-03-2011 18:19

svkp
 
is it possible to get code from protected encrypted blocks ? or just manual breakin and dump ?

Pansemuckl 05-26-2011 08:58

Id be interested in it too

DARKER 05-26-2011 15:03

Try look on "SVKP Explorer" maybe it help you little bit. I think last public version is 0.2e.

orfei 06-05-2011 18:34

Is possible in hand (or script) with olly. I do decryption several times before long time.
Basicly in manual mode (and as i remember):
1. Break on OEP.
2. Find where is encrypted code block/s by comparing svkp begin marker.
3. Set new origin on start code block. Step several times to run over decryption routine.
You will see how below code is decrypted (and looks like x86 code).
4. Asemble start/end of crypted code block with jmp (to avoid crypt again and to make good code for dumping).
5. Do above procedure for all crypted blocks.
6. Return origin to OEP and dump.
now is time for imp reconstruction :)


All times are GMT +8. The time now is 10:39.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX