View Single Post
  #5  
Old 05-30-2004, 14:36
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To hobgoblin:

Sorry I couldn't upload it to the exetools, please pm with your email.

It is an asprotect beta,so I am not going to put detailed steps for unpacking it in the open forum, for the obvious reason,but there aren't that many steps anyway, just find where asprotect is directing the iat , force it to make the table for you, use ImportRec to fix the table.second , overcome the antidump.done.

in my unpacking I concentrated on the iat , so for time limitation, I didn't redirect the antidumps, I just used the same high memory as asprotect, and code small dll as finger saving for that purpose,Also I didn't redo the process for fixing the iat for the five or so left apies, I just code them directly, you will distinguish my direct adding form ImportRec adding.

since I am using a high memory, it may not work if your configuration is different than mine, I will try to redirect the antidumps in the future, to avoid that.
here is an image of some jumps to iat to show the ones I directly added and the imortRec adding:

Last edited by britedream; 05-30-2004 at 16:56.
Reply With Quote