![]() |
|
#1
|
|||
|
|||
|
Help with cracking Trymedia Activemark app
Target is protected with Trymedia Activemark 5.41.1210
Steps taken so far crack: 1.Start the target and go to the "enter the code" page. 2.Open latest PE_Tools 3.Select target and do full dump 4.Do "Get OEP". Note down those OEPs. 5.Disassemble dumped target in IDA. Check noted OEPs. Found what looks like correct OEP at B5D024 Start imprec, select the target. Punch in B5D024 (our possible OEP) and press "IAT autosearch". imprec says "cant find good imports" Next, put address and size of .idata segment into ImpRec. It finds valid IAT entries plus bad thunks. Delete bad thunks (IDA says no parts of the code call these "bad thunks" so they must not be valid parts of the IAT). Then do "fix dump" on the dumped exe file. Resulting dump wont run. hxxp://users.tpgi.com.au/adsloptd/target.zip is the origonal packed target hxxp://users.tpgi.com.au/adsloptd/rct3d_.rar is my current dump Can anyone tell me what I am doing wrong or how to get this target to actually run? I also tried an OEP of 0129064F (which is what PeID said the OEP is) but that didnt make it run either. Hopefully someone can tell me how to get this target running ![]() I also managed to get IceExt running at last. If I run with SoftIce not loaded at all, target works and displays "enter key" screen. If I run with SoftIce loaded and protection off, I get "anti-debugger" message. If I run with SoftIce loaded and protection on, program loads and silently terminates. So I have no way (at least that I can see) to use SoftIce on this target (e.g. to be sure what the OEP really is) The target detected OlyDbg too. Last edited by jonwil; 05-24-2005 at 13:18. Reason: More info |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Does Trymedia Activemark do encrypted data files? | jonwil | General Discussion | 3 | 05-26-2005 19:13 |
| Trymedia's ActiveMark Protection?!?! | Seventh | General Discussion | 7 | 10-25-2004 14:36 |