SilSaLaMaTa
June 14th, 2002, 16:35
hi ,
I have problems while unpacking asprotect under WinXP Pro.
While using RV ,
1- I choose the tracer and Select the prog , 0x400000 as low eip and 0x500000 as high eip , then clicked on Start , RV didn't start to trace the prog , 0 as Last eip and nothing happens .
2- my computer suddenly restarts and I try to find OEP with soft ice .
I put a break point on NtContinue (solomons trick) and traced the prog , after SYSENTER the prog contiues .
I searched for 61,ff,e0 , and put a break point (after second break on NtContinue) . I tried BPM and BPX . but the prog ignores the break points .
I put a bpx on Getversion , and searched for 61,ff,e0 (found at AD3924) . then
I put a break point on NtContinue again and restart the prog , after second break I searched for "Jmp [ebp-14]" , found at ABFB73 , then BPX on AB7b73 , BPM AD3924 W, I traced the prog until "POPAD , JMP EAX" . EAX is 52A488 , I think it's not the OEP .
cause imgae base is 0x400000 .
the prog is Essential NetTools v.3.0 (build 86 , i think) at http://www.tamos.com .
sorry for my English .
I have problems while unpacking asprotect under WinXP Pro.
While using RV ,
1- I choose the tracer and Select the prog , 0x400000 as low eip and 0x500000 as high eip , then clicked on Start , RV didn't start to trace the prog , 0 as Last eip and nothing happens .
2- my computer suddenly restarts and I try to find OEP with soft ice .
I put a break point on NtContinue (solomons trick) and traced the prog , after SYSENTER the prog contiues .
I searched for 61,ff,e0 , and put a break point (after second break on NtContinue) . I tried BPM and BPX . but the prog ignores the break points .
I put a bpx on Getversion , and searched for 61,ff,e0 (found at AD3924) . then
I put a break point on NtContinue again and restart the prog , after second break I searched for "Jmp [ebp-14]" , found at ABFB73 , then BPX on AB7b73 , BPM AD3924 W, I traced the prog until "POPAD , JMP EAX" . EAX is 52A488 , I think it's not the OEP .
cause imgae base is 0x400000 .
the prog is Essential NetTools v.3.0 (build 86 , i think) at http://www.tamos.com .
sorry for my English .