VBOX upnacking question

[Jay]

Originally Posted by hobferret

OK ivanov

Just very quickly unpacked target with Ollydbg

OEP==0056EA64

IAT
START@006C6018
END@006C6E84

So I don't know why you are only "seeing" one function

Forgot how easy VBOX 4.1 was

/hobferret

groan, that was a wasted d/l I hadn't even installed it yet

[hobferret]

Jay

I would not waste your time unpacking it

It's a program for a specific purpose, obviously ivanov needs it for his work/play, fair dinkum to him

To be honest I have just kept hold of the IAT in case he comes back for more info, the rest has vanished

/hobferret

[ivanov]

thanks man, i will try it again now..
btw, why don't you give the IAT table file straightaway? ;-)..

to be honest, someone challanges me whether I can unpack the sw, so I said, I have lots of skillful friends ---> out here <--- for asking help.

[ivanov]

I have found the IAT :-), thanks to you, hob. But, the problem remains :-(, I can't run it on Win9x system. Error: ".... file is linked to missing export Advapi32.dll-463". But, anyway, it is enough for me to learn about vbox for now :-)..
thanks guys..at least i got the working exe on win xp sp2..

[hobferret]

ivanov

Common problem with running programs on different systems are the IAT ordinals

WINXP Advapi32.dll Ordinal 0463 is RegCreateKeyW

and

WINME Advapi32.dll does not have Ordinal 0463, in ME it's Ordinal 0223

So all you need to do is check out what the values are, the easiest way to repair (change) it is by using LPE

/hobferret

[ivanov]

you are great man,...i'll try it and back to you when facing a problem