Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #1  
Old 09-01-2004, 15:31
hobgoblin hobgoblin is offline
Friend
 
Join Date: Jan 2002
Posts: 124
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 2
Thanks Rcvd at 5 Times in 5 Posts
hobgoblin Reputation: 0
Arma question (again...)

Hi guys,
I'm currently looking at a target that somehow puzzles me, and I could use some input. (Target is DVDCoverprint from northcardinal.com). When I scan with PEID is says that the file is protected with Arma 3.00a - 3.61. When I run the program, I can see that there are two processes created (copymem2). Okey, it looks good. Then I use Olly, and use HideDebugger and set a bp WriteProcessMemory. And nothing happens. Olly doesn't stop at breakpoint. The program ends up in a loop without getting out of it. The loop can be beaten, but then the program terminates. When I try to set other bps like ReadProcessMemory, Olly doesn't stop then either. Okey, maybe the program detects Olly. When I try to use a renamed version of Olly, the same thing happens. And same things happens when I use he instead of bp.
When I try to set a bp GetProcAddress from the beginning (to take a look at what kind of api's that's being used in the creation of the second process (son), Olly only stops at FindWindowA. After that, same thing as described above happens.
Have anyone seen this? And if so, have anyone successfully managed to unprotect a program with this version of Arma?
All kinds of input is welcomed.

hobgoblin
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ASPR, ARMA question sgdt General Discussion 3 04-09-2006 03:38
About Arma hobgoblin General Discussion 1 02-02-2004 19:53


All times are GMT +8. The time now is 17:07.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )