I found it. Sorry for troubling the board...
regards,
hobgoblin



Greetings to all of you.
I have been studying Asprotect lately (yes, I know: Be careful with posting questions about this soon to be "worned out" protections system- And it is with a certain fear of being flamed that I post one question. I have been reading most of teh stuff posted on this board, and I have learned a lot. But there is one thing that eludes me.
I have just read Splaj's splendid work on the subject. But therre is one thing I quite can't figure out. Take a look at this:

(Written originally by Splaj..):

0167:00E2CA17 90 NOP
0167:00E2CA18 6A00 PUSH 00
0167:00E2CA1A E8597AFFFF CALL KERNEL32!GetModuleHandleA <==DUMMY API for IAT rebuilders !
0167:00E2CA1F FF355036E300 PUSH DWORD PTR [00E33650] <==GetCommandLineA API
0167:00E2CA25 58 POP EAX <==POP'd into EAX !!!
0167:00E2CA26 C3 RET <==in aspr OK, but STACK WRONG for us

See the GetModuleHandleA in EAX is discarded, EAX is pop'd with GetCommandLineA ptr !!!

I understand what's going on, but exactly how do you guys know that it is the CetCommandlineA API that eax is pop'ed with? When I do a d eax or u eax, I don't see something I understand, or something that gives me a hint. When I do a u 00E33650, I come up with this:
016F:01154648 0000 ADD [EAX],AL
016F:0115464A 40 INC EAX
016F:0115464B 0041A4 ADD [ECX-5C],AL
016F:0115464E E4FF IN AL,FF
016F:01154650 FC CLD
016F:01154651 86F4 XCHG DH,AH
016F:01154653 810000000000 ADD DWORD PTR [EAX],00000000
016F:01154659 0000 ADD [EAX],AL

(the address is different than Splaj's listings; I'm on WinME right now...)

I can't see where to find a pointer to what kind of api that is the "valid one", and not the dummy one.

Is this something you just know from experience or what?

Some input on this would be very much appreciated. And if you want, email me your input.

Hob,

I've reviewed ur history here, seems u r struggling a bit.....we can help U anytime

Please keep trying. U will get there eventually, then u can buy me a Guinness

Spl/\j

Yes, your da....... right I'm struggling a bit.:-) I'm bit by bit learning the bits and tits of asprotect. I did know how to unpack the earliest version, but then I decided to do some other things for almost a couple of years. And when I came back to the reversing scene everything had changed. I managed yesterday to unpack Commview, following your tut step by step. Today I've been diving into this new scheme set up, with the apis spread all over the place.:-)
As far as I can see, I'm going to be busy for a while learning the secrets....
But I have plenty of time, and there is a lot to read. I will eventually get the hang of it.:-)
BTW, thanks for all the information you have supplied over the years. Nice to see someone willing to pass on their knowledge. And that goes for most of the people on this board.

I'll post my questions as they arise, be sure of that.

regards,
hobgoblin

Well for one thing, the call is such:

0167:00E2CA1F FF355036E300 PUSH DWORD PTR [00E33650]

This is a indirect address pointer operation. Disassembling the 00E33650 address will give you nothing that makes sense. What you want is to disassemble the address that is found AT 00E33650.

In SI after you U the address if it's in an API the name of the API will be shown in the module window. I'm sure you already know that of course tho, just a reminder

Anyway, if you are totally unsure about which call it really is, there is a simple technique. YOu know that ASPR can only "fake" these calls in this way at the beginning of the program's startup, and no after. For example, GetCommandLineA is only called once in most programs, at startup time. So you know what the value is going to be, right ! ?! After the ASPR redirected call, just walk thru it and see what the return is, and compare it with what it should be. Piece of cake.

There are several other emulated API's that ASPR uses like this too, such as GetCurrentProcess, or GetCurrentProcessID. Some of these you can simply find by doing the "PROC" command in SI. It will show you all the values. If the ASPR emulated return value is one of these, then SHazAM! You've found which API is supposed to be there. Don't trip up over GetCurrentProcess by the way. The return value of this function in windows is not the REAL value, it is a "psuedo-handle", the value is usually something like 7FFFFFFFF. If you see that value, you got yourself a GetCurrentProcess call on your hands.

Remember, use your brain, your MSDN, and SI and you can do almost anything.

-nt20

Thanks a lot.:-)
I'm grateful for the input. I was somehow on the track of it already, and you filled out a gap there..
I'm just started going through Crusaders tutorial on Reget, and I guess I will be busy for a while...

regards,
hobgoblin

Hi
I know it can be off topic here, but i've came back after a loooong
time and i'm happy to see some old friends here.
hobgoblin, how are you my friend ? How's life and the family ?
I'm ok and so is the family, busy in real life, but nice to jump here from time to time
I see you are still in this unpacking stuff, nice work, keep up the great work of yours.

Regards
the snake
(the original one. i saw that there are now 2 new "the snake" around here)

Hi Th_snake,
Don't worry you won't get flame ;D

Hi snake..
Nice to see you here. I was beginning to wonder if you had withdrawn from the whole scene..-)
As you can understand, I've been busy with other things myself (school, carriere, wife...), but somehow I can't stay away from the reversing scene in general, and this board in particalur. Wonder why...:-)
Now I have some time on my hand, and thought I wanted to dive into the whole asprotect thing. As you may remember the packing; and therefore unpacking, contains a lot of challenges. It sure helps developing my understanding of assembly dealing with this kind of protectons. And you know what? I unpacked my first Asprotect proggie today. And it worked after some tracing and patching. I must say, Asprotect surely has been developed since we first dealt with its earliest version(s).
Well, I have to stop before I get seriously flamed here.
Take care out there, snake.
I'll be seeing you here later on.....

hobgoblin

Hi hob
2 years ago, on May 2000 you wrote a tutorial about "How to unpack, crack and patch a packed copy of AZPR 3.01", protected by one of the first versions of this packer... It is on my site, at the guests section, a good leason for anyone intend to learn basics of unpacking.

One thing that stops me to go deeper in this packers is the changes they make from "day to day" (other one is language and more)...

C U around