Log in

View Full Version : For newbiez-ASsPROT-unpacker help


evaluator
September 10th, 2002, 21:09
I see very many place is trushed on this MB because of ASS-emulated IAT-tricks.
So for help to MB(!) I wrote here some easy-generic info.

Emulated APIS for latest ASsPR ordered by their adress in ASsPR module:
(calculated from base of ASsPR module)

1 base+10EE8 =======KERNEL32.dll GetProcAddress
2 base+1133C =======KERNEL32.dll GetModuleHandleA
3 base+11358 =======KERNEL32.dll GetVersion
4 base+11388 =======KERNEL32.dll GetCurrentProcess
5 base+11390 =======KERNEL32.dll GetCurrentProcessId
6 base+1139C =======KERNEL32.dll GetCommandLineA
7 base+113B4 =======KERNEL32.dll LockResource
8 base+113C4 =======KERNEL32.dll FreeResource

--
Sometimes also is emulated 1 API from USER32.DLL====DialogBoxParamA

PS.

BAD NEWZ:
usualy when ASS read thiz, he will update..

GOOD NEWZ;
we are here..&

_WE WILL,
___WE WILL,
_____ROCK YOUUUUUUU! <-protz

[Licensed to QUEEN]

kalisto
September 11th, 2002, 07:15
Long live our friend AL SOLODNIKOV.

Dr.Golova
September 11th, 2002, 13:10
Quote:
[I]
1 base+10EE8 =======KERNEL32.dll GetProcAddress
2 base+1133C =======KERNEL32.dll GetModuleHandleA
3 base+11358 =======KERNEL32.dll GetVersion
4 base+11388 =======KERNEL32.dll GetCurrentProcess
5 base+11390 =======KERNEL32.dll GetCurrentProcessId
6 base+1139C =======KERNEL32.dll GetCommandLineA
7 base+113B4 =======KERNEL32.dll LockResource
8 base+113C4 =======KERNEL32.dll FreeResource
[/B]


But where DllFunctionCall for VB progz ???

evaluator
September 11th, 2002, 16:31
Dr.Golova!

Can't understand you.
Explain.

DakienDX
September 11th, 2002, 17:11
Hello Dr.Golova !

evaluator wrote the information to tell newbies what imported DLL functions ASProtect emulates to confuse the reverser and the import rebuilder.

Now ask yourself, which of the functions evaluator pointed out are used in Visual Basic programs?

If a function isn't imported or the DLL isn't even used, ASProtect doesn't emulate these functions.

Very simple to understand, but your question was also quite confusing.
You could try to explain your problem or your question as bit more detailed next time.
So non-native english people like evaluator (and like yourself) will be able to understand it.

evaluator
September 11th, 2002, 18:00
DX!

Dr.Golova is NOT newbz.

Maybe he jokes?

LaptoniC
September 11th, 2002, 23:42
No He is not joking here is the list of emulatedapis by aspr

_type=1 ---->GetModuleHandleA kernel32.dll
_type=2 ---->GetVersion kernel32.dll
_type=3 ---->GetVersionExA kernel32.dll
_type=4 ---->GetCurrentProcess kernel32.dll
_type=5 ---->GetCurrentProcessId kernel32.dll
_type=6 ---->GetCommandLineA kernel32.dll
_type=7 ---->LockResource kernel32.dll
_type=8 ---->FreeResource kernel32.dll
_type=9 ---->SizeofResource kernel32.dll
_type=A ---->DialogBoxParamA user32.dll
_type=B ---->DllFunctionCall MSVBVMxx.dll

if it is vb app dllfunctioncall is also emulated.

DakienDX
September 11th, 2002, 23:50
Hello LaptoniC !

OK, this was my fault.

I'm no Visual Basic user and I've never seen it anywhere.

So I thought "DllFunctionCall" would be some synonym for "Any function imported from the VB runtime library".

evaluator
September 12th, 2002, 07:17
Heh!

Never hear, somebody asked for help-unpack asspoted VB...
Curious! (& how i like vb00)

OK. "Thanks for your submission", Dr.Golova!

Dr.Golova
September 13th, 2002, 11:56
Quote:
Originally posted by evaluator
Heh!

Never hear, somebody asked for help-unpack asspoted VB...
Curious! (& how i like vb00)

OK. "Thanks for your submission", Dr.Golova!


As we know, in VB you can't create any exported functions for using aspr API, so DllFunctionCall used in VB applications for communications with aspr layer, like GetProcAddress in native app (normally DllFunctionCall used in VB for calling any external dll function). I'm unpack several VB progz and always found this emulated function (yeah, only one emulated stub). aspr plugin for Revirgin can't resolve it Surely, manual fix this shit is very easy, but who knows....