![]() |
|
#1
|
|||
|
|||
|
problem with asprotect 1.2x-1.3x
hi to all,
well I load app in peid and its say asprotect 1.2x-1.3x [registered], go to last exepction bp on memory access and i land here: 00406A2C -FF25 C0D24F00 JMP DWORD PTR DS:[4FD2C0] ; kernel32.GetModuleHandleA 00406A32 8BC0 MOV EAX,EAX 00406A34 -FF25 BCD24F00 JMP DWORD PTR DS:[4FD2BC] ; kernel32.LocalAlloc 00406A3A 8BC0 MOV EAX,EAX 00406A3C -FF25 B8D24F00 JMP DWORD PTR DS:[4FD2B8] ; kernel32.TlsGetValue 00406A42 8BC0 MOV EAX,EAX 00406A44 -FF25 B4D24F00 JMP DWORD PTR DS:[4FD2B4] ; kernel32.TlsSetValue now interesting thing is that imprec resolve all functions,except GetProccAddress,so I dump app here at 00406A2C fix dump and program wont run, its always go to kernel32.exit thread. Now,this is not real oep,so I think that app maybe use stolen bytes or stolen code tehnics, anyone expierence this problem? any sugestions? |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| ASprotect Problem | p4r4d0x | General Discussion | 12 | 05-19-2018 16:17 |
| problem.................................... | nikicraki | General Discussion | 3 | 12-13-2003 21:03 |
| IDA 4.17 problem | loman | General Discussion | 2 | 08-21-2002 18:35 |