ASProtect Verion Detection
Q: how to detect exact ASProtect version?
A: extract TASP object and analyze it.
Q: What is TASP object?
A: TASP object - it's ASProtect DLL used in protected application to perform all protection tasks (e.g. license keys managment). You can extract it from ASProtect.exe (ASProtect itself) resources (RCData -> TASP).
When ASProtect protects an executable, it attaches TASP to protected exe. TASP is packed by aPLib and ASPack, PE structure replaced by own (much easy).
Q: How to extract TASP from protected application?
A: Method 1: Execute protected app under debugger, wait until TASP is unpacked by ASPr stub and dump TASP to disk, place correct PE header (read tutorials about it - there are good old articles for v1.2x by crUsAdEr).
Method 2: Find compressed TASP in .aspr section, decompress and reconstruct it.
Method 3: Use tool for automatic TASP extraction like asdd tool by seeQ or VerA plugin for PEiD/DiE by PE_Kill
So, when you'll get unpacked TASP (ASProtect.dll), you can analyze it with any crypto ananlyzer (for ex. KANAL).
Attached:
VerA 0.15 (PEiD Plugin)
ASProtect v2.3 06.26 ASProtect.dll [TASP] (ready to ananlyze)
ASProtect v2.3 06.26 TASP (from resources, packed)
|