Log in

View Full Version : "OutLine-Patch Studio" for ASSp.


evaluator
May 7th, 2002, 13:20
Hello!
I in 98% finished "OutLine-Patch Studio" for ASSp!

PreReview:
1. I patched ASS.DLL and repacked, so uSer must replace original with thisOne;
2. This SEXASS.DLL will unpack UNPACKEBLE and decrypt IAT.
AFTER this it reterns execution to specified place, WHERE uSer puts his
Own Code (on't crack, plEasE and jumps to OEP.

Before full finish & rEleasE, I need some info from you:

A. Is something like this released from someone?

B. If some of you done inline patch for latest vers off ASSp,
can you give it to me (not tut, but real working), so I will see, is it easy then my studio???

binh81, Spekk,..., want You test+upgrade?

crUsAdEr
May 7th, 2002, 13:54
LOL... okie.. looks like interest in AsProtect will never die...

Okie... how do i get the beta version from you?? But isnt it troublesome for user to replace the dll? Not quite sure what you mean, email me the thing with a clear documentation on how to install driver, where to plug the cable etc... in English of course, not french :>...

Get the inline patch from the Desperate Website, cracks by FlawLess.... kickme.to/Desperate...

I am not sure if anyone has release anything like this?... Doesnt matter... this is learning only....

Check your PM for my email :>

cheers,
crUsAdEr

SilberFuchs
May 7th, 2002, 16:55
the patchs of FlawLess are made with AIPH ??(AsprotectinlinepatchHelper; work of Global)
..i don't know if AIPH is avaiable for public!??


@Global: ich bin nicht verschwunden! aber du hast auf meine Mails seit einiger Zeit nicht mehr geantwortet

ciao
SilberFuchs

evaluator
May 7th, 2002, 17:21
OK, but can you point to prog with inline...

SilberFuchs
May 7th, 2002, 18:51
email??
i don't upload a patch here...

GlObAl
May 7th, 2002, 20:17
Hello,
Evaluator my goal was it to make an small sulotion for ASPR protected programs so i think an inlinepatch was the best sulotion in my eyes!
Silberfuchs is right all the patches from FlawLeSS are made with AIPH and it was not public yet it will support ASPR versions 1.21 and higher... Silberfuchs your version is too buggy so plz donīt make it public.
I think the best way to learn how its work is to download the patch from FlawLeSS for Tag&Rename because there are not much regged patch in it... debug it completly and try to understood and if you have questions ask me or maybe Silberfuchs will help you too.
Donīt try the one from CommView its to much patched and it will maybe confused you too much for the begining.

P.S.: Silberfuchs habe dir mal ne Testmail geschickt hoffe das sie angekommen ist...

evaluator
May 7th, 2002, 20:27
CommWiev?
What version patch you mean?

GlObAl
May 7th, 2002, 20:45
Hello again,
evalator i mean maybe you donīt start to analays ip with the CommView patch it was for the v3.3 build 205 but every time the patch come out some days later they rls an new build
Start with Tag & Rename, DX Atlas,IE Security Pro,Online monitor and so on... because CV need much patch to make it regged and so they was much more bytes in the exe and so it was harder to understood only the ASPR ip ...

Regards

SilberFuchs
May 7th, 2002, 21:36
no problem Global

hab dir auch vorhin ne Testmail geschickt

ciao
SilberFuchs

figugegl
May 8th, 2002, 01:58
@sifu:

--- snip ---
Das hältst du ja im Kopf nicht aus! ...This hold you yes in the head not out!
--- snip ---

* LOL * - i like the english version - * LOL *

figugegl

crUsAdEr
May 9th, 2002, 20:30
Hi GLOBAL...

Mighty impressive... you do know AsProtect inside out dont you :>>... looks like you have done lots of work on that AsProtect... do share ur knowledge with us sometimes...

Regards,
crUsAdEr

eval... you cruel one... my Hex Workshop died comparing the file you sent me...

GlObAl
May 10th, 2002, 11:30
Hello,

sure i will help if i can if you have questions i will try to explain... and iam sure Silberfuchs will help too he has started for me to ip aspr and for him it was Onekelis or so ... and the first ever on never versions was ViperZX with CloneCD i think ... hehe but iam not sure, so donīt care of it...

i get an email from this board and i will answer here.

Q:In a reply u say that many patches r inliners, so it must be possible for a newbie as me to do it.?

A:Yes its possible if you have not much knowlenge in IP and so you will need a tool like AIPH or the other interesting tool that was postet in a nother thread it was in french maybe it do the same but i havent check it atm because i can no french :/
The other way is you trace one of the patches from FlawLeSS and try to learn from it as i say it was near to everytime the same on new ASPR versions. And if you have questions ask here.

Q:is the patching code taking care of the crc checks, or injected/written in certain areas of the file so crc check don't find'em, or maybe crc on the file on disc is avoided only, and then hides the rest of the code in certain mem locations

A:Yes you inject the ip in the aspr code and you can than fully control it this mean you can patch with one byte the CRC it was an simple 74 -> EB you will find it after tracing a bit from createfilemappinga. But if you patch the file and aspr in it the OEP will fail and this is the mainprotection from the Author but after thinking a bit over it i find an realy easy way to defeat it... yes the main working for the ip was this:

1 first you have to solve the 4-5 layers at the begining, you can recalculate or you try like me too brute 1 byte to breack out form the layers.
2 take the imagebase from ASPR and store it to build your whole ip on it
3 patch CRC 1 byte to get not the errormsg
4 patch if it was there 30 Daytrial
5 let ASPR do the whole unpacking
6 so now he as unpack the app and the boríng i CRC for OEP calculation beguns but how care ? i know the OEP so i jump by my IP to the OEP... with
mov eax, OEP
jmp OEP

i think thats all for now...

P.S.: Silberfuchs habe keine Mail bekommen darauf hin habe ich jetzt ne neue Mailaddy glo_bal@reallyfast.info teste mal bitte...

npanic
May 18th, 2002, 18:10
Thanks GlObAl for useful info.

Now i think i have some stuff to work with for a while.

BTW, me unpacking = cow stepdancing ;-)