rot8
March 12th, 2001, 05:13
Another new version of asprotect found.
Target was (unpacked & defeated =)http://homesoft.agava.ru/homebuh_download.htm (russian program).
1.Some new boring IAT tricks (GetProcAddress like, but now other funcs are involved: GetCommandLineA, GetCurrentProcessID, Free/LockResource, GetModuleHandleA, GetVersion ).
2.Integrity check slightly changed.
You have to dump program before ...[tsss, AS never sleeps :]..., otherway you will fix and fix and fix your dump =)
BTW: Last CASPR doesn't work.
SAC and UG where have you been ?
Target was (unpacked & defeated =)http://homesoft.agava.ru/homebuh_download.htm (russian program).
1.Some new boring IAT tricks (GetProcAddress like, but now other funcs are involved: GetCommandLineA, GetCurrentProcessID, Free/LockResource, GetModuleHandleA, GetVersion ).
2.Integrity check slightly changed.
You have to dump program before ...[tsss, AS never sleeps :]..., otherway you will fix and fix and fix your dump =)
BTW: Last CASPR doesn't work.
SAC and UG where have you been ?
