VBOX upnacking question

[ivanov]

D-Jester,
is there any generic manual unp for vbox? my target is protected with vbox 4.10, how to reach the OEP using Olly? btw, is your tuts applicable for this version?

[N0P]

Originally Posted by ivanov

D-Jester,
is there any generic manual unp for vbox? my target is protected with vbox 4.10, how to reach the OEP using Olly? btw, is your tuts applicable for this version?

this tut is applicable for (IMHO) all vBox craps (maybe privilege) or you can try eCRap OEP verify plugin for PEID by MAXX...
http://www.exetools.com/forum/showthread.php?t=4160

[ivanov]

yes, i have followed that tuts and also the one from D-jester. It "seemed" I reached the OEP, but no exe's worked. Please, I need more guidance. Here is my target:
h__ttp://www.qfile.de/dl/33934/target.rar.html.

[Jay]

Originally Posted by ivanov

yes, i have followed that tuts and also the one from D-jester. It "seemed" I reached the OEP, but no exe's worked. Please, I need more guidance. Here is my target:
h__ttp://www.qfile.de/dl/33934/target.rar.html.

hey ivanov,
target requires at least 2 non-system dll's not included in the archive.
vboxp410.dll
GEAR32PD.dll

[D-Jester]

Hello ivanov, please PM me with a download link for the FULL package, I can't run this on my system without its dependacies.

Thanks

[hobferret]

Hi ivanov

Likewise, PM the link

Don't know what exactly the program is but sounds like some old Adobe thing

/hobferret

[ivanov]

I have tried Lunar_Dust tuts "Unpacking VBOX 4.6.2 (Privilege Client)
Semi - Manually�..". I don't fixed the import table, just change the EP manually after dumping the program using LordPE. It works fine on Win XP SP2. But, I cannot run it on Win ME. It seems IAT is the problem, but I am not sure to fix it, :-).

The only imported function I see when loading the original program into ImpRec, entering the OEP I just found (using Lunar_Dust tuts, or the one that PEiD suggested), is Kernel32.dll. I don't know why ..:-).

[hobferret]

Hi

From what I remember of VBOX4.1, the entry point is from the PREVIEW section

The last 2 instructions I think (if I remember correctly) are:-

PUSH FFFFFFFF
CALL EAX - - > To EIP

LONG TIME AGO vbox4.1

/hobferret

If you have a dump and it wont run, have you fixed the IAT

[ivanov]

right,hobferret.
i have reached that section and jump into the call, do nothing and dumped the process using OllyDump. After fixing IAT, i got only one valid imported function and the exe is not working/error.

[hobferret]

Hey man

If you only have one reference in the IAT it has gotta be wrong

When at the IAT check to see where the calls are from, do a search for FF25 and you should find the IAT area, make a note of it and use that in Imprec

/hobferret