PDA

View Full Version : problem with ollybone


ramtin
July 4th, 2015, 08:17
Hi all
I try to use ollybone, but I got bellow error

OLLYBONE ABORT:Kernel driver load returned staus 2

I follow t-9317.html , but still not work!
my system is:
win xp 32bit on vmware workstation

any idea?!

Kayaker
July 4th, 2015, 11:53
Hi

Unfortunately Ollybone doesn't work on a VM. If you try it on a real XP system you will probably find that it does work correctly, depending on the packer.

I had worked with the sources for a while to try to figure it out, I think it might have had something to do with the (VM emulated) dTLB not being flushed correctly. I actually did get it working a few times by forcing a flush somehow, but it wasn't stable and more often than not locked up the VM.

If you google around a bit you can find a couple of other mentions of Ollybone not working on a VM. There may be other options, but I'm not sure of the current state of automatic unpacking solutions.

Oh, btw: the load error you're getting, which was your actual question, does have to do with ollybone not finding the driver, if you keep messing with the suggestions in the thread you linked you should be able to get it loaded. But, it still won't unpack in a VM

Kayaker

ramtin
July 7th, 2015, 12:18
Hi
thanks for reply. I have only a 64 bit system, when I try to load ollybone, I got "operating system 6.1 not supported" error. Is there any 64 bit version or any ollybone alternative?

Kayaker
July 7th, 2015, 20:58
What is it you're trying to unpack? You might want to browse these

http://www.woodmann.com/collaborative/tools/Category:Automated_Unpackers

http://indefinitestudies.org/2008/09/25/automatic-unpacking/ (old but informative)

ramtin
July 9th, 2015, 11:10
the packer can not detected by PEID, EXEINFO and RDG packer detector, because of unknown packer automatic unpackers cant unpack it!

evlncrn8
July 27th, 2015, 16:41
can you upload it somewhere?