Help with cracing Trymedia Activemark app

[TmC]

I don't know anything about the target app and trymedia system but i can guess that IF you did the right job it might have a sdk where developer checks for presence of the envelope and if not it crashes the program but it is only a supposition.

[Nacho_dj]

Hi jonwil:

First, take a look at the following thread: ActiveM***, in
http://www.exetools.com/forum/showthread.php?t=7013

maybe there you will get a clue.


Could you tell us which is the program you are dealing with?

I have totally rebuilded and working "Chuzzle Puzzle", that has the same AM version 5.41.1210.

I am hard testing an already developed generic unpacker but not yet published, because sometimes the program rebuilded, even working well, ask for the CD.
And another times, rebuilded program says things like: "You need Shockwave Player 8.5 installed in your PC".

I want a totally free of errors unpacker, giving always a working program, before publishing it.

The OEP, as I said in a post in the above thread, when edited in an hex editor, is below the string '_com_err': is the first value you find in that column that is bigger than the position of the first section and smaller than the position of first section plus the size of first section.

In your rebuilded program, you still need to fix all the call's and mov than uses redirections to AM functions. AM picks fetch to functions of some DLL and rewrite them to call to AM functions, that are controlling the trial time, the registration of the program, and so on.
All of them all always preceeded by a nop.

Good luck in your research!


Cheers from Spain!

Nacho_dj

[dyn!o]

ActiveMark is a weak protection. It detects most of the tools with a very primitive methods.

You cannot run SICE because AM searches for the following devices (and drivers) NTICE, SICE, SIWVID, FROGSICE, SUPERBPM. It was good but few years ago.

If I run with SoftIce loaded and protection on, program loads and silently terminates

Let me guess. You had SICE / FileMon / RegMon / LordPe or ImpRec running at the same time. Try to run it without any additional tools and it will work (with IceExt protection turned on).

Also think about breakpoints. AM detects them and will refuse to run if you set any (CC). Use hardware breakpoints since AM does not operate on debug registers.

Hope that helped. Good luck.