foxthree
February 28th, 2002, 13:39
Hello there:
To test some unpacking theory, I was trying my hand at unpacking RegOrganizer by ChemTable Software (http://www.chemtable.com). I found one reference to this software by _spl/\j and wanted to test his theory.
However, the version number has been bumped up and I guess this is a new version. I've found out the "double-dipping" that asprotect does just like +spl/\j mentions:
once at 0041B068
and then jumps back into unpacking code and finally the OEiP itself is at 00419DF8
I ran Revirgin (latest beta) on this target and it shows only re-directed/emulated api. I press on resolve again but now it shows imports only from KERNEL32.dll and no other DLLs!
This seems to be a major bug in RV as if I use this import table and rebuild as +spl/\j mentions, the application GPFs due to a wrong import!
Also few other observations:
(1) Whenever I try to trace or api emulate the system just freezes or reboots. The RefCount is not zero or is not listed (blank).
(2) Why always references only to KERNEL32.dll? What about other DLLs?
BTW, I'm running on Win98SE.
Is there something that I'm missing here or is it a RV bug?
Thanks.
Signed,
-- FoxThree
To test some unpacking theory, I was trying my hand at unpacking RegOrganizer by ChemTable Software (http://www.chemtable.com). I found one reference to this software by _spl/\j and wanted to test his theory.
However, the version number has been bumped up and I guess this is a new version. I've found out the "double-dipping" that asprotect does just like +spl/\j mentions:
once at 0041B068
and then jumps back into unpacking code and finally the OEiP itself is at 00419DF8
I ran Revirgin (latest beta) on this target and it shows only re-directed/emulated api. I press on resolve again but now it shows imports only from KERNEL32.dll and no other DLLs!
This seems to be a major bug in RV as if I use this import table and rebuild as +spl/\j mentions, the application GPFs due to a wrong import!
Also few other observations:
(1) Whenever I try to trace or api emulate the system just freezes or reboots. The RefCount is not zero or is not listed (blank).
(2) Why always references only to KERNEL32.dll? What about other DLLs?
BTW, I'm running on Win98SE.
Is there something that I'm missing here or is it a RV bug?
Thanks.
Signed,
-- FoxThree