Dillo protected DLL

[JMI]

5Alive:

You are SETTING A VERY BAD EXAMPLE for the newbies by constantly answering your own Posts when no one has responded. I have combined several of your Posts.

THIS IS THE REASON THERE IS AN EDIT BUTTON!

Use the EDIT BUTTON to add comments to your previous Post if there have been no Replies.

Regards,

[5Alive]

Apologies for my for poor etiquette JMI. I was just exercising my train of thought, I'll seek to do this in smaller confines from now on.

@taos thanks for replying. I understand what you are saying about dumping within the time limit.

I have since managed to find the OEP using AvAtArs script and dump the DLL. I need to look into fixing the IAT as I understand that this has been destroyed.
The dump certainly doesn't work at the moment.
UPDATE:I attached to the DLL using impREC and it already has the correct OEP displayed? I wasn't expecting that to be the case.

There are no invalid thunks. I selected fix dump and try to run it, and it fails saying that the program is damaged with a bad sector or virus.

Any suggestions where I'm going wrong?



I have already tried using the John Who's Trial Doctor 1.3, it doesn't find any registry entries but it does find and delete a .tmp file. This isn't enough to reset the trial period.

For the moment, I just restored an image that was created before installing the target. I read that I need to use a reg snapshot tool of some sort and monitor the Win folder to find what is being changed.

5aLIVE

[taos]

Originally Posted by 5Alive

There are no invalid thunks. I selected fix dump and try to run it, and it fails saying that the program is damaged with a bad sector or virus.

This is a CRC check, so if you've removed all dillo code and like DLL code can not checksum itself (because you can not read your code AFTER dillo protect it) it sounds like a lenght file check.
you must trace DLL and search for createfilea or another similar api (use search button in this forum, this topic has been posted several times).

Regards.