? Question about Asprotect 1.2 degbugger detection

Hello all,
this is my first post here

I have never done any manual unpacking before. So the answer may be easy.. or maybe considered too indepth for the likes of me.

There is a program I'm "working" on that is protected by "ASProtect 1.23 RC4 - 1.3.08.24". None of the unpackers I've seen have been able to unpack it. I have found a couple of tutorials for manually unpacking Asprotect, however they both use ollydbg. That would be fine except for the fact that this program can detect debuggers and keeps me from following the directions in the tutorial.

This is not important enough for me to accomplish if it will require spending lots of time finding and stripping this debugger protection or using softice.

I guess this post is just a question of "Does anyone know of a quick way around the debugger detection (without using softice)?"

Thanks for your time. -b

[goggles99]

Get the IsDebuggerPresent plugin from here hxxp://ollydbg.win32asmcommunity.net/stuph/

Furthermore... don't use hardware breakpoints, because ASProtect detects them...

[JMI]

And read the FAQ Forum at the top of the list, so you'll know the Rule about posting "Thank You" type posts before you have 10 Posts of some substance. But he already knows you are greatful anyway.

regards,

[Michel]

Hi zambuka,

I am french, so excuse my bad english....

When you run a prog protected by ASProtect 1.23 RC4 - 1.3.08.24, there is an other small .exe witch is created and located in the temp folder.

This file is very temporary because it create a .bat file, "del.bat", in order to delete itself and finally delete himself too.

You can found the exact name and location of this .exe looking at the runnig threads with procdump, ollydbg or what you want.
Windows don't allow you to copy this file, but, on XP, if you set his properties to "read only", it will not be deleted by del.bat nor overwrited by the main prog next time you run it, and this is more important

Thus, you can close the main prog and disassemble the temp .exe witch is not crypted : you will see that the main use of this file is to detect a few knowed debuggers : you can patch that easily, but don't forget to leave the patched file in "read only" state before runnig the main app.

I hope this can help you...