VBOX upnacking question

[hobferret]

Hi ivanov

Likewise, PM the link

Don't know what exactly the program is but sounds like some old Adobe thing

/hobferret

[ivanov]

I have tried Lunar_Dust tuts "Unpacking VBOX 4.6.2 (Privilege Client)
Semi - Manually�..". I don't fixed the import table, just change the EP manually after dumping the program using LordPE. It works fine on Win XP SP2. But, I cannot run it on Win ME. It seems IAT is the problem, but I am not sure to fix it, :-).

The only imported function I see when loading the original program into ImpRec, entering the OEP I just found (using Lunar_Dust tuts, or the one that PEiD suggested), is Kernel32.dll. I don't know why ..:-).

[hobferret]

Hi ivanov

Is it by any chance set last error

/hobferret

[hobferret]

OK ivanov

Just very quickly unpacked target with Ollydbg

OEP==0056EA64

IAT
START@006C6018
END@006C6E84

So I don't know why you are only "seeing" one function

Forgot how easy VBOX 4.1 was

/hobferret

[Jay]

Originally Posted by hobferret

OK ivanov

Just very quickly unpacked target with Ollydbg

OEP==0056EA64

IAT
START@006C6018
END@006C6E84

So I don't know why you are only "seeing" one function

Forgot how easy VBOX 4.1 was

/hobferret

groan, that was a wasted d/l I hadn't even installed it yet

[hobferret]

Jay

I would not waste your time unpacking it

It's a program for a specific purpose, obviously ivanov needs it for his work/play, fair dinkum to him

To be honest I have just kept hold of the IAT in case he comes back for more info, the rest has vanished

/hobferret

[ivanov]

thanks man, i will try it again now..
btw, why don't you give the IAT table file straightaway? ;-)..

to be honest, someone challanges me whether I can unpack the sw, so I said, I have lots of skillful friends ---> out here <--- for asking help.

[ivanov]

I have found the IAT :-), thanks to you, hob. But, the problem remains :-(, I can't run it on Win9x system. Error: ".... file is linked to missing export Advapi32.dll-463". But, anyway, it is enough for me to learn about vbox for now :-)..
thanks guys..at least i got the working exe on win xp sp2..

[hobferret]

ivanov

Common problem with running programs on different systems are the IAT ordinals

WINXP Advapi32.dll Ordinal 0463 is RegCreateKeyW

and

WINME Advapi32.dll does not have Ordinal 0463, in ME it's Ordinal 0223

So all you need to do is check out what the values are, the easiest way to repair (change) it is by using LPE

/hobferret