Begginers in ASPR unpacking
 

This may help some of you that are having trouble with stolen bytes in ASPR and finding the OEP its a quick walkthrough so dont start a flame war its just for the begginers.

Thanks very much :D

Will check it out i always wanna learn ;)

Thanks for the tut.

ysco.

Thanks!!

paul333

Nice !!

I will try to understand and practise to do

thx!

Yeah, thanks from me too, any tuts for newcomers are appreciated.:)

thanks alot for that tut.:)

hey something I understand, that makes sense :D

now all I guess I have to do is figure out how to make the program not detect Olly :D


I have managed to un-pack my Victim but it won't run, I know it must be patched, and it dosen't seem to do much good to work with the un-packed code..


I know there is a way to hide olly but I still haven't figured it out yet..


Thanx for sharing ...

Hi lonewolf55,

I usually use DeJunk plugin for the IsDebuggerPresent checks
altho i got this Hide Debugger v1.01 by Asterix the other the day

give it a go

best Wishes

R@dier

Thanx so much for your post.....

I haven't DL'ed your attachment yet, I'm not at the computer where it needs to be right now....

I don't want to turn this into an Olly help Thread... but I guess I have to ask this....


What I meant by saying "I know there is a way to hide olly but I still haven't figured it out yet" is that when I look at all the settings in Olly as in options and such.. I'm just not sure how to add a plug-in to it..

I'm very familiar with Wdasm and some what familliar with IDA, but very new to Olly ... I do know Sice and I use Smartcheck quite often.. most of my experience is with VB reversing, Delphi reversing, and reversing Installer type scripts .. it's just recent that I am trying to learn about reversing Protectors.

Do you mind if I send you a PM...

Thanx again for your help :D

Hi,

No Probs, always happy to help


R@dier

Thanx again for the plugin .. I figured it out just put the dll into the directory that Olly is installed in and when opened it's there, also it works just fine...

duh :D my bad.. trying to make things more difficult than need be...