Puyover
June 27th, 2009, 11:23
Hi everyone!
I'm trying to unpack a aplication (a game) which is packed into MoleBox 2.5.7
This is the exe: COMMERCIAL SOFTWARE - LINK DELETED BY MODERATOR
Here I paste the data that I have got:
1. EP: 003B6B33 + 00400000 = 007B6B33
OEP: 00699EDA - 00400000 = 00299EDA
ImageBase: 00400000
SizeOfImage: 003D0000
Start of IAT: 002B9000 + 00400000 = 006B9000
End of IAT: 006B9000 + 0000065C = 006B965C
Size of IAT: 0000065C
2. First bad entry: 006B90FC -> A4 44 7C 00 -> Blackout.007C44A4
3. Entry which destroy the good entries: "007BE432 MOV DWORD PTR DS:[ECX],EAX"
Well, I fix that entry with a NOP and there are no more bad entries, but when I "get import" with Import Reconstructor it shows too many invalid entries :S
Some help?
PD: Sorry my bad English <.<
I'm trying to unpack a aplication (a game) which is packed into MoleBox 2.5.7
This is the exe: COMMERCIAL SOFTWARE - LINK DELETED BY MODERATOR
Here I paste the data that I have got:
1. EP: 003B6B33 + 00400000 = 007B6B33
OEP: 00699EDA - 00400000 = 00299EDA
ImageBase: 00400000
SizeOfImage: 003D0000
Start of IAT: 002B9000 + 00400000 = 006B9000
End of IAT: 006B9000 + 0000065C = 006B965C
Size of IAT: 0000065C
2. First bad entry: 006B90FC -> A4 44 7C 00 -> Blackout.007C44A4
3. Entry which destroy the good entries: "007BE432 MOV DWORD PTR DS:[ECX],EAX"
Well, I fix that entry with a NOP and there are no more bad entries, but when I "get import" with Import Reconstructor it shows too many invalid entries :S
Some help?
PD: Sorry my bad English <.<