Mathcad 2001 demo is a toughie for vbox

U can find the oem point easy enough 00420906 using marigolds
lesson.Tsehp then goes on to list the decoding routine in VBOXT which xors and xors the 05 or 04 in the table at rva 24000.

Actually i have used revirgin to unravel all the jumps/calls from 24000 on for D28.Ive now got alist of all the subroutines from this point.Interestingly enough though if u try and run it it slips into the abyss after a call to winmain and trashes.

This is a good protection.not sure if this will ever be fixed.
This may be the biggun.

beanhauler

Sure there's no API emulation or hooking in the app? I know this is rare for a vbox app, but it's certainly possible. That way as soon as the app is stripped of it protection, it'll crash - which is what it seems like it's doing to you.

hmm think this is a new way from the makers of vbox
Perhaps Tsehp may have some comments.
Thanks for the reply though its good to know there are others
out there

Beanhauler

dreamweaver, probabbly other macromedia apps, wordperfect, probably other corel apps, delphi, painter.. others
all these apps trial comes with new-age possibly "secret" versions of vbox labeled "4.3" .. but is it 4.3?

aladdin systems sneaking around behind crackers backs

I just cooked up Corel Graphics Suite 11 and Wordperfect Suite 10.. both currently available as trials from the site... nothing to indicate "stealth" versions. Floorplan 3D by IMSI was protected by 4.3 but it was really 4.3

see it's easier to believe that it wasn't my cracking skills but rather a vbox conspiracy..
sigh.. thx for the followup