Hi Yates !
A tiny little victory for me this time .... better than nothing....
I've finally succeded in getting a good I.T. thanks to SD2 itself (good guy !)... but it still not working at all, because of the replacements in sourcecode's CALLs...
I've got tears in my eyes because I've traced and traced this code during hours... I put so much BPM between original ciphered data leading to temporary buffers .... it was horrible... but so good in fact.
Well, I still can't understand when and how the sourcecode is modified so that different CALLs use only one I.T. vector.... was it before ciphering or is it done 'on the fly' by SD2 ??? Please, help !, I'm dying !...
you can see below my litlle victory to get a good (but not working) I.T.
017F:1009545C 8B45EC MOV EAX,[EBP-14]
017F:1009545F 8D8C10FF020000 LEA ECX,[EDX+EAX+000002FF]
017F:10095466 8B55E8 MOV EDX,[EBP-18]
017F:10095469 8B4518 MOV EAX,[EBP+18]
017F:1009546C 890C90 MOV [EDX*4+EAX],ECX <<< HERE ... I.T. vectors are created in temp buffer
017F:1009546F 7809 JS 1009547A
017F:10095471 90 NOP
017F:10095472 87FF XCHG EDI,EDI
017F:10095474 7F09 JG 1009547F
017F:10095476 87F6 XCHG ESI,ESI
017F:10095478 7E05 JLE 1009547F
017F:1009547A 7400 JZ 1009547C
017F:1009547C 78F3 JS 10095471
017F:1009547E 038B4DE88B55 ADD ECX,[EBX+558BE84D]
017F:10095484 248D AND AL,8D
017F:10095486 048A ADD AL,8A
017F:10095488 8B4DE8 MOV ECX,[EBP-18]
017F:1009548B 69C94B030000 IMUL ECX,ECX,0000034B
017F:10095491 8B55EC MOV EDX,[EBP-14]
017F:10095494 89840A32030000 MOV [ECX+EDX+00000332],EAX
017F:1009549B E91FFFFFFF JMP 100953BF
017F:100954A0 8B4D14 MOV ECX,[EBP+14]
017F:100954A3 C1E102 SHL ECX,02
017F:100954A6 33C0 XOR EAX,EAX
017F:100954A8 8B7DD4 MOV EDI,[EBP-2C]
017F:100954AB 8BD1 MOV EDX,ECX
017F:100954AD C1E902 SHR ECX,02
017F:100954B0 F3AB REPZ STOSD
017F:100954B2 8BCA MOV ECX,EDX
017F:100954B4 83E103 AND ECX,03
017F:100954B7 F3AA REPZ STOSB
017F:100954B9 8B45D4 MOV EAX,[EBP-2C]
017F:100954BC 50 PUSH EAX
017F:100954BD 6A00 PUSH 00
017F:100954BF 8B0D84850B10 MOV ECX,[100B8584]
017F:100954C5 51 PUSH ECX
017F:100954C6 FF1590700910 CALL [KERNEL32!HeapFree]
017F:100954CC C745F400000000 MOV DWORD PTR [EBP-0C],00000000
017F:100954D3 EB09 JMP 100954DE
017F:100954D5 8B55F4 MOV EDX,[EBP-0C]
017F:100954D8 83C201 ADD EDX,01
017F:100954DB 8955F4 MOV [EBP-0C],EDX
017F:100954DE 8B45F4 MOV EAX,[EBP-0C]
017F:100954E1 3B4514 CMP EAX,[EBP+14]
017F:100954E4 735A JAE 10095540
017F:100954E6 8B4DF4 MOV ECX,[EBP-0C]
017F:100954E9 C1E903 SHR ECX,03
017F:100954EC 8B55F8 MOV EDX,[EBP-08]
017F:100954EF A110460C10 MOV EAX,[100C4610]
017F:100954F4 8B1490 MOV EDX,[EDX*4+EAX]
017F:100954F7 33C0 XOR EAX,EAX
017F:100954F9 8A040A MOV AL,[ECX+EDX]
017F:100954FC 8B4DF4 MOV ECX,[EBP-0C]
017F:100954FF 83E107 AND ECX,07
017F:10095502 BA01000000 MOV EDX,00000001
017F:10095507 D3E2 SHL EDX,CL
017F:10095509 23C2 AND EAX,EDX
017F:1009550B 85C0 TEST EAX,EAX
017F:1009550D 752F JNZ 1009553E << NOP this call, you get original I.T.
017F:1009550F 8B45F8 MOV EAX,[EBP-08]
017F:10095512 69C08D000000 IMUL EAX,EAX,0000008D
017F:10095518 8B0D14460C10 MOV ECX,[100C4614]
017F:1009551E 8B54014C MOV EDX,[EAX+ECX+4C]
017F:10095522 8B45F4 MOV EAX,[EBP-0C]
017F:10095525 8B0C82 MOV ECX,[EAX*4+EDX]
017F:10095528 51 PUSH ECX
017F:10095529 8B55F8 MOV EDX,[EBP-08]
017F:1009552C 52 PUSH EDX
017F:1009552D E8FE000000 CALL 10095630
017F:10095532 83C408 ADD ESP,08
017F:10095535 8B4DF4 MOV ECX,[EBP-0C]
017F:10095538 8B5518 MOV EDX,[EBP+18]
017F:1009553B 89048A MOV [ECX*4+EDX],EAX <<< here, SD2 overwrite datas in temp buffer by original ones.
==> 1009553E EB95 JMP 100954D5
017F:10095540 EB07 JMP 10095549
thanx.

))
blak.