Help with cracing Trymedia Activemark app

[jonwil]

So, is there some way I can fix my dump so that when I start at the "2nd layer EP" I dont crash and instead get working code?
Or do I need to start at origonal EP and fixup the "nop call" and "encrypted data files" myself?

I found the table with the functions in it but unfortunatly, the "calls" are 0.
So it looks like (unless someone else has a binary with usable values in it) fixing up all the calls for version 5.41.1210 of ActiveMark has to be done by hand. Ditto the decrpytion of encrypted files

Either that or some solution has to be found where you can use the 2nd layer EP and then modify the code between the 2nd layer EP and the OEP of the program somehow so that the "nop call" instructions and the encrypted data files are correctly setup/read/decoded but without any crashes or errors.

I have tried everything to get this to work but it seems no-one knows anything about 5.41.1210 of ActiveMark (or what steps to take to sucessfully crack it).

With the info out there, I am surprised no-one has made a "generic" ActiveMark unpacker that can unpack AM directly I see several people saying "I am working on it but it doesnt unpack everything yet so I dont want to release it" (even if it doesnt unpack everything, mabie it might unpack to working some targets, mabie even mine

I also have the .lcn file from someone who has the target (in "C:\documents and settings\All Users\Application Data\Trymedia\licenses") but the target wont recognize as "unlocked".

Is it because there is more data that goes with the licence somewhere? Or is it because the .lcn file is locked to a particular machine? Is there some way to get the target to use this licence file (I cant just type the "unlock code" into the trymedia window because it talks to the internet to check if its valid)

[Nacho_dj]

Hello:

Unfortunately, when the AM equivalences table has the second field to zero, you need, at least once, tracing the nop + call till a call to a function of DLL appears in the obfuscated code. A good way is using always F8 (not to enter the calls in the obfuscated AM code) to get faster the function name that nop + call is replacing to. No more than 1 minute tracing and the function name appears.

Then, you have got the function name and the value of AM redirection. Just do as I have explained before to go filling an equivalences array in your program, that will work for every same AM release program. The found values for every AM call found in your program probably do not cover the entire AM equivalence table, and you have to repeat this procedure of tracing every time you are facing new values for the AM equivalences table. But with several programs (4 or 5) maybe you will have found the main redirections for all programs.


If you try to search the AM equivalences table in old AM releases, such as 2.x.xx or 4.x.xx you will find them with the two fields not equal to zero easily, so providing you all the equivalences for you generic rebuilder.


Another issue talking about Import table is that AM erases some functions of DLL from the import table.

So, when you replace the nop + call for the correct call, guided by the AM equivalences table, you could get an impossible reference due to this fact.

Then, it is necessary adding this 'disappeared function' to the import table. This requires, as you could imagine, rewrite a lot of calls of the program in order to correctly fetch the proper functions.


You see, is a hard task but done carefully you will get a good fix for the program.

This has to be written down in a tutorial, I know. Let me first follow testing the rebuilder for all known AM releases.

jonwil, I am trying to attach the rebuilded target but I cannot, do not know why. Is there another public place where I could hang it? Maybe it is the big size (similar to yours) that is preventing the upload.

Cheers!

Nacho_dj