Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #7  
Old 10-12-2014, 18:42
mm10121991 mm10121991 is offline
VIP
 
Join Date: Feb 2011
Posts: 136
Rept. Given: 29
Rept. Rcvd 56 Times in 34 Posts
Thanks Given: 7
Thanks Rcvd at 24 Times in 13 Posts
mm10121991 Reputation: 58
You don't need hwbp. After reaching oep, you just need to trace every redirected jump or call because there are no direct jumps or calls. Do not use shortcut ways. Trace the code and you will find places where to catch the redirected api.

http://ge.tt/47K8CN12/v/0
here you will find a few helper scripts to unpack obsiduim 4.x targets.
For the iat script, you have to modify this lines
mov iatb, 00B6B1B0 // start of iat
mov iate, 00B6C66C //end of iat
and make eip point to one of the redirected calls or jumps

Those scripts have worked on many 4.x targets but i don't guarantee they will always work.
Reply With Quote
The Following User Gave Reputation+1 to mm10121991 For This Useful Post:
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Adobe protection scheme Dark Intentions General Discussion 0 07-09-2015 03:35
Request for a good protection scheme in Java DaGoN General Discussion 7 02-20-2014 04:42


All times are GMT +8. The time now is 00:05.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )