Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #23  
Old 12-01-2003, 17:03
britedream britedream is offline
Friend
 
Join Date: Jun 2002
Posts: 436
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
britedream Reputation: 0
To svensk:
I did unpack dap, here the info:
oep and Iat is given earlier,but stolen bytes are:

004C7B2A > $ 55 PUSH EBP
004C7B2B . 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
004C7B32 . 83EC 68 SUB ESP,68
004C7B35 . 64:FF35 00000000 PUSH DWORD PTR FS:[0]
004C7B3C . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
004C7B3F . 33DB XOR EBX,EBX
mov dword ptr ss:[ebp-4],ebx ; [missed]
004C7B41 . FF15 70204E00 CALL NEAR DWORD PTR DS:[<&msvcrt.__set_app_type>] ; msvcrt.__set_app_type
pop ecx [missed]
004C7B47 . 830D 703D5300 FF OR DWORD PTR DS:[533D70],FFFFFFFF
004C7B4E . 830D 743D5300 FF OR DWORD PTR DS:[533D74],FFFFFFFF
004C7B55 . FF15 6C204E00 CALL NEAR DWORD PTR DS:[<&msvcrt.__p__fmode>] ; msvcrt.__p__fmode
004C7B5B . 8B0D 3C3A5300 MOV ECX,DWORD PTR DS:[533A3C]
004C7B61 . 8908 MOV DWORD PTR DS:[EAX],ECX
004C7B63 . FF15 34204E00 CALL NEAR DWORD PTR DS:[<&msvcrt.__p__commode>] ; msvcrt.__p__commode
004C7B69 . 8B0D 383A5300 MOV ECX,DWORD PTR DS:[533A38]
004C7B6F . 8908 MOV DWORD PTR DS:[EAX],ECX
004C7B71 . A1 3C204E00 MOV EAX,DWORD PTR DS:[<&msvcrt._adjust_fdiv>]
mov eax,dword ptr ds:[eax] ; missed
004C7B76 . A3 6C3D5300 MOV DWORD PTR DS:[533D6C],EAX

at address :48bc63 = push 48bd65 ,retn
copy section 00C00000 from orignal file to the unpacked
and svkp1.3 will be history.

britedream
Regards

Last edited by britedream; 12-07-2003 at 22:26.
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
svkp infern0 General Discussion 3 06-05-2011 18:34
SVKP 1.3x unpacking codeX General Discussion 10 01-28-2005 22:03
The new svkp 143 britedream General Discussion 3 09-19-2004 22:22


All times are GMT +8. The time now is 13:30.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )