View Single Post
  #15  
Old 05-26-2005, 06:16
jonwil jonwil is offline
VIP
 
Join Date: Feb 2004
Posts: 399
Rept. Given: 2
Rept. Rcvd 21 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 67 Times in 35 Posts
jonwil Reputation: 21
So, is there some way I can fix my dump so that when I start at the "2nd layer EP" I dont crash and instead get working code?
Or do I need to start at origonal EP and fixup the "nop call" and "encrypted data files" myself?

I found the table with the functions in it but unfortunatly, the "calls" are 0.
So it looks like (unless someone else has a binary with usable values in it) fixing up all the calls for version 5.41.1210 of ActiveMark has to be done by hand. Ditto the decrpytion of encrypted files

Either that or some solution has to be found where you can use the 2nd layer EP and then modify the code between the 2nd layer EP and the OEP of the program somehow so that the "nop call" instructions and the encrypted data files are correctly setup/read/decoded but without any crashes or errors.

I have tried everything to get this to work but it seems no-one knows anything about 5.41.1210 of ActiveMark (or what steps to take to sucessfully crack it).

With the info out there, I am surprised no-one has made a "generic" ActiveMark unpacker that can unpack AM directly I see several people saying "I am working on it but it doesnt unpack everything yet so I dont want to release it" (even if it doesnt unpack everything, mabie it might unpack to working some targets, mabie even mine

I also have the .lcn file from someone who has the target (in "C:\documents and settings\All Users\Application Data\Trymedia\licenses") but the target wont recognize as "unlocked".

Is it because there is more data that goes with the licence somewhere? Or is it because the .lcn file is locked to a particular machine? Is there some way to get the target to use this licence file (I cant just type the "unlock code" into the trymedia window because it talks to the internet to check if its valid)

Last edited by jonwil; 05-26-2005 at 16:00. Reason: more info
Reply With Quote