Rage
November 4th, 2001, 11:36
1) Whith non-packed apps everything is ok and IDA uses correct flirt signatures
, but if the app (eg ASProtect) is packed - I unpack it, dump it and load it with IDA, wait till the analysys finishes and then I load FLIRT signatures, but nothing happens
- the analasys (L1 - first pass of FLIRT) lasts only a few seconds and there are no functions found. Is there solution to this problem??
2) Is there a way to unpack pieces of code created with ASProtect macros REG_CRYPT_BEGIN and REG_CRYPT_END. Can caspr do it (or any other unpacker?), can it be done manualy?
, but if the app (eg ASProtect) is packed - I unpack it, dump it and load it with IDA, wait till the analysys finishes and then I load FLIRT signatures, but nothing happens
- the analasys (L1 - first pass of FLIRT) lasts only a few seconds and there are no functions found. Is there solution to this problem??2) Is there a way to unpack pieces of code created with ASProtect macros REG_CRYPT_BEGIN and REG_CRYPT_END. Can caspr do it (or any other unpacker?), can it be done manualy?

If you have it, use it, run "hidden" feature, and crypted code wall be decrypted by ASProtect kernel. Now just dump code section and paste it to dump. May be little patch needed after this operation - program must be sure thet hi is registered for running encrypted part.