![]() |
|
|
|
#1
|
|||
|
|||
|
OK people, since no one has responded yet I will tell you what I have so far. Let me also state that I am a newbie in unpacking manually, hey I am a developer not a reverser.
How do I detect whether this app uses DiscGuard: The following files exist in the installation directory: IOSLINK.VXD IOSLINK.SYS The main exe (xxx.exe) is encrypted and the decryption key is somehow inscribed in the CD, this is how DiscGuard works. The xxx.exe imports two dlls, T6111.dll and MSVBVM60.DLL. The xxx.exe imports ordinal functions: T6111.dll:1 MSVBVM60.DLL:0277h (rtcMidCharBstr) The T6111.dll exports two functions. PEid IDs it as "Microsoft Visual C++ DLL Method 1", Linker Info: 5.0, In other words a MSVC 5.0 dll. The KANAL v2.8 Krypto analyzer plugin reports the followin: BLOWFISH[sbox]::0002BC48::1202E048 -BLOWFISH: Sbox 2 PI fraction(NIMBUS/BLOWFISH)::0002BC00::1202E000 Fractional part of PI number - 640 bits. Used e.g. in BLOWFISH (pbox & sbox) or NIMBUS (fixed key). When I try to load the xxx.exe into Olly it lands somewhere inside T6111.dll and reports: Access violation while writing to [004001E4], that probably is where the decrypted code was being writen into the in-memory image of xxx.exe ??. I don't know what to try next. The very mention of BLOWFISH encryption means that I am out of my league. So, it looks like I need to read some Intro. Tutorials about manually unpacking such exes, any pointers anyone. And please don't point me to an attachment, I can't download yet. |
![]() |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Removing Obfuscation | Git | General Discussion | 4 | 01-04-2012 19:35 |
| Removing UPX protection? (compressed file) | Rhodium | General Discussion | 4 | 08-11-2003 19:50 |