Hey, I'm new to manual unpacking.. Been plugging away at unpacking an asprotected .EXE & I've had a *little* success

I used the loader.exe (mentioned in other posts), dumped w/ ProcDump and rebuilt the IT w/ ImpREC. The unresolved API calls I resolved w/ the list evaluator posted (thnx evaluator). Revirgin didn't seem to resolve ANY API calls which was wierd.. I corrected the GetVersion entry (GetCommandLineA).

The result? I have an executable that actually runs (<grin> - a first for me w/ asprotect hehe). However, if I load the .EXE in OllyDbg I get the following message:

Bad or unknown format of 32-bit executable file

If I try to use IDA, I get:

Can't find translation for virtual address 001600AC

The .EXE doesn't seem to be quite up to par yet. Any suggestions?

-pknight

PS. Is there a SuperBPM equivalent for NT SICE? I'm running SICE under XP and my breakpoints/p ret's aren't triggering

PSS. are string refs too much to hope for w/ an asprotect unpack?

(thanks in advance!)

OK!

You NeeD update your tool!
Download new LordPE & use it as dumper and as rebuilder.

in Rebuilder's Option choose:
Status window; Dumpfix; Validate PE;

now dump program, rebuild all & see what happens.

This error can be caused by Ollydbg being overly cautious about exe formats, and happens regularly on dumped aspr targets.
It can be fixed with a 1 byte patch to Ollydbg itself. Olly knows about the problem but just hasn't gotten around to fixing it yet.

Here are the bytes from an *OLDER* version of Olly. Just search for the same pattern in the new version, and FORCE the jump in question:

0044D75F 837DF402 cmp dword ptr [ebp-0C], 00000002
0044D763 7513 jne 0044D778 // FORCE JUMP TO AVOID BAD EXE ERROR

0044D765 8D4E50 lea ecx, dword ptr [esi+50]

0044D768 51 push ecx

* Possible StringData Ref from Data Obj
-> "Bad or unknown format of 32-bit "
->"executable file '%s'"

0044D769 687D0B4900 push 00490B7D

What do you mean by string refs being hoped for?

Usually just dumping the program will give you the string references clean. If not, maybe you got a bad dump. It happens sometimes !

-nt20

Just to follow-up on this..

Using LordPE as a dumper resolved my problem!! I didn't even need to use the Rebuild PE feature because ImpREC seemed to take care of dump fixing for me.

Stone, thanks for the OllyDbg tip btw. If it gives me grief in the future, I'll make use of your patch

-pk