Tried unpacking DVDIdle Pro - AsProtect

[britedream]

To lonoise:

Yes this is the first error I mentioned, if you fix the address to points to an address where you coded your name then this will show that it is registered to you.

[britedream]

To svensk and maltese,

please discard the dump file I sent you , olly didn't write the patch as it should you will notice that to goes to an empty space.

some strange things happen with this program , I will check them and let you know.

To britedream: Yes, I noticed that. But still the program is registered in your name. Weird

And btw the code where you entered the PUSH, is executed after the splash screen is shown.
I'm talking about the code at 401779.

[britedream]

these are the errors area I had, if you fix them it will run:

1-
004043AE /74 0F JE SHORT dvd_.004043BF
004043B0 |50 PUSH EAX
004043B1 |E8 90AB0100 CALL <JMP.&msvcrt.strlen>
004043B6 |. |85C0 TEST EAX,EAX
004043B8 |. |59 POP ECX ; dvd_.0040352D
004043B9 |. |76 04 JBE SHORT dvd_.004043BF
004043BB |. |33C0 XOR EAX,EAX
004043BD |. |40 INC EAX
004043BE |. |C3 RETN
004043BF |> \33C0 XOR EAX,EAX
004043C1 \. C3 RETN

2-
00401770 . 8975 FC MOV DWORD PTR SS:[EBP-4],ESI ; dvd_.0042C0F0
00401773 . FF35 28214200 PUSH DWORD PTR DS:[<&kernel32.CreateThre>; kernel32.CreateThread
00401779 . B8 D8A44200 MOV EAX,dvd_.0042A4D8
0040177E . FFD0 CALL NEAR EAX
00401780 . EB 0F JMP SHORT dvd_.00401791

this is what I had and fixed.

now the strange thing I found , in fixed dump at the oep which working with no problem so far, I did check the iat to see if it is well, I found out that around four addresses has been over written, so I changed importrec option from create new iat, to rebuild original, that corrected the problem. so please check the iat made by asprotect unpacker I am curious to see.

[britedream]

To svensk

registeration is in error # 1 in my above post while the missed patch is in error 2, which is after splash.

[britedream]

To lownoise
I don't know if it is truely registered or not , but try to keep your dump target name slightly different from the original name.

[britedream]

edit by britedream
To lownoise:
target will run outside olly with fixing only the first error, and will run in olly if you checked to ignore memory access voilation.
it uses asprotect region 990000, which is no longer there

Where's the push in your exe to read the name at 444600 ?

Britedream,

I don't had to make any modifactions other then error 1 you specified. why do you have to make any changes on error 2

Britedream,

Looks like i'm still learning everyday.
app works registered now

lownoise