Tried unpacking DVDIdle Pro - AsProtect

Well I've finally did it!

I have successfully traced the AsProtect code to the point it loads the Serial# from the Registry without any SEH ERRORs

I have confirmed that it makes 4 copies of the key (for a total of 5).
It will try to strip out any spaces from the key. Valid keys have no spaces.
DVDIldle Pro uses the following string for a look-up (which I believe is to re-create the name of the registered person- working on this now.. not sure just yet on this one):
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/= $()[]{},::-_\*

I am taking VERY good notes at the moment to see how the code is tracing thru the key. I'm tired at the moment. I'll continue tomorrow.

For those that wish to participate.... my research was correct on my last message. You must trace into the code from the beginning with MOV DWORD PTR FS:[EAX],ESP in the SET CONDITION BOX.

When Olly breaks you must NOP the following XOR[EAX],EAX
then continue with CTRL+F11 until you NOP the XOR[EAX],EAX at address location: $974350.

Once you've NOPd $974350 single step past... then BP on address $974652, single step till after the CALL $965264. Now BP on $96962D.

You will now be at the RegOpenKeyExA call. Just F8 till you get to the RegQueryKeyExA. And viola...

Hope this helps.

Now the fun part begins...

Not bad for a Newbie huh?

-Malt

P.S. You can use the same technique for PowerStrip too guys... the address's are different...but use the same technique.

Race you to the finish MaRKuS.... LOL (I would lose that one).