miltantof
June 13th, 2002, 22:34
Hi guys, great forum!
my status : not quite a newbie yet
my problem : asprotect
the exe : hide folders 2.2.1.171 (www.fspro.net)
--------------------------------------------------
The unpacking and IAT rebuilding of the 2.0 version of this program posed no problem and the unpacked program works without a flaw.
2.2 is different.
Here's what I did:
- I found the oep and dumped at 004749c4
- realigned the sections with procdump
- reconstructed the IAT with ImpRec 1.4.2+
- changed the ep with procdump
- at 00474A22 I nopped out the call to the "internal error" message box
- and at 004037E6 I changed the je to jne (which caused another error message)
Now this is what happens:
If the original exe is loaded into memory my unpacked exe apparently works, but if the original
exe is not loaded my exe crashes with the following message :
"Access violation at address 00000009. Write of address 7074613d"
W32Dasm tells me that this coded address is not in a loaded module.
I'm totally lost. I'm hoping for a kind soul willing to shed some light and help me find my way home.
my status : not quite a newbie yet
my problem : asprotect
the exe : hide folders 2.2.1.171 (www.fspro.net)
--------------------------------------------------
The unpacking and IAT rebuilding of the 2.0 version of this program posed no problem and the unpacked program works without a flaw.
2.2 is different.
Here's what I did:
- I found the oep and dumped at 004749c4
- realigned the sections with procdump
- reconstructed the IAT with ImpRec 1.4.2+
- changed the ep with procdump
- at 00474A22 I nopped out the call to the "internal error" message box
- and at 004037E6 I changed the je to jne (which caused another error message)
Now this is what happens:
If the original exe is loaded into memory my unpacked exe apparently works, but if the original
exe is not loaded my exe crashes with the following message :
"Access violation at address 00000009. Write of address 7074613d"
W32Dasm tells me that this coded address is not in a loaded module.
I'm totally lost. I'm hoping for a kind soul willing to shed some light and help me find my way home.