Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 05-24-2005, 11:14
jonwil jonwil is offline
VIP
 
Join Date: Feb 2004
Posts: 399
Rept. Given: 2
Rept. Rcvd 21 Times in 9 Posts
Thanks Given: 2
Thanks Rcvd at 67 Times in 35 Posts
jonwil Reputation: 21
Help with cracking Trymedia Activemark app

Target is protected with Trymedia Activemark 5.41.1210
Steps taken so far crack:
1.Start the target and go to the "enter the code" page.
2.Open latest PE_Tools
3.Select target and do full dump
4.Do "Get OEP". Note down those OEPs.
5.Disassemble dumped target in IDA. Check noted OEPs.
Found what looks like correct OEP at B5D024
Start imprec, select the target.
Punch in B5D024 (our possible OEP) and press "IAT autosearch".
imprec says "cant find good imports"
Next, put address and size of .idata segment into ImpRec.
It finds valid IAT entries plus bad thunks.
Delete bad thunks (IDA says no parts of the code call these "bad thunks" so they must not be valid parts of the IAT).
Then do "fix dump" on the dumped exe file.
Resulting dump wont run.
hxxp://users.tpgi.com.au/adsloptd/target.zip is the origonal packed target
hxxp://users.tpgi.com.au/adsloptd/rct3d_.rar is my current dump

Can anyone tell me what I am doing wrong or how to get this target to actually run?

I also tried an OEP of 0129064F (which is what PeID said the OEP is) but that didnt make it run either.

Hopefully someone can tell me how to get this target running

I also managed to get IceExt running at last.
If I run with SoftIce not loaded at all, target works and displays "enter key" screen.
If I run with SoftIce loaded and protection off, I get "anti-debugger" message.
If I run with SoftIce loaded and protection on, program loads and silently terminates.

So I have no way (at least that I can see) to use SoftIce on this target (e.g. to be sure what the OEP really is)
The target detected OlyDbg too.

Last edited by jonwil; 05-24-2005 at 13:18. Reason: More info
Reply With Quote
 


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Does Trymedia Activemark do encrypted data files? jonwil General Discussion 3 05-26-2005 19:13
Trymedia's ActiveMark Protection?!?! Seventh General Discussion 7 10-25-2004 14:36


All times are GMT +8. The time now is 16:28.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )