View Single Post
  #6  
Old 09-15-2006, 23:24
Jupiter's Avatar
Jupiter Jupiter is offline
Lo*eXeTools*rd
 
Join Date: Jan 2005
Location: Moscow, Russia
Posts: 234
Rept. Given: 43
Rept. Rcvd 62 Times in 37 Posts
Thanks Given: 38
Thanks Rcvd at 191 Times in 57 Posts
Jupiter Reputation: 62
Post ASProtect Verion Detection

Q: how to detect exact ASProtect version?
A: extract TASP object and analyze it.

Q: What is TASP object?
A: TASP object - it's ASProtect DLL used in protected application to perform all protection tasks (e.g. license keys managment). You can extract it from ASProtect.exe (ASProtect itself) resources (RCData -> TASP).

When ASProtect protects an executable, it attaches TASP to protected exe. TASP is packed by aPLib and ASPack, PE structure replaced by own (much easy).

Q: How to extract TASP from protected application?
A: Method 1: Execute protected app under debugger, wait until TASP is unpacked by ASPr stub and dump TASP to disk, place correct PE header (read tutorials about it - there are good old articles for v1.2x by crUsAdEr).
Method 2: Find compressed TASP in .aspr section, decompress and reconstruct it.
Method 3: Use tool for automatic TASP extraction like asdd tool by seeQ or VerA plugin for PEiD/DiE by PE_Kill
So, when you'll get unpacked TASP (ASProtect.dll), you can analyze it with any crypto ananlyzer (for ex. KANAL).

Attached:
VerA 0.15 (PEiD Plugin)
ASProtect v2.3 06.26 ASProtect.dll [TASP] (ready to ananlyze)
ASProtect v2.3 06.26 TASP (from resources, packed)
Attached Files
File Type: rar VerA_015.rar (46.3 KB, 92 views)
File Type: rar ASProtect_23_0626.rar (118.3 KB, 51 views)
File Type: rar TASP_23_0626.rar (133.1 KB, 58 views)
Reply With Quote