ASPR: stolen bytes neccessary?!
 

i've unpacked many aps with asprotect now... and now i've a question...

do i really need the stolen bytes? i've written this to the oep, and the apps worked without any stolen bytes...
push ebp
mov ebp, esp
add esp,-010
mov eax,******* <<<< this is only if i've found a eax-value

the apps worked so far... no problems...

A lot of the time I find that the actual stolen bytes are simply parts of the standard startup code for a certain compiler, so once you know what it's been compiled with, it's normally easy to replace the stolen bytes by simply copying and pasting from another program compiled in the same way. Certainly easier than trying to find the original bytes, and much faster :)

Re: ASPR: stolen bytes neccessary?!
 

coz those bytes you mentioned is just to set up the stack frame and reserve some space for local variables. No need to restore the stack coz this procedure will never return due to ExitProcess/TerminateProcess call.