Log in

View Full Version : Defeating PCGuard v5.0


SvensK
November 29th, 2003, 07:39
Thought I'd whip up a few quick notes on how to unpack PCGuard v5.0.

1. Load PCGuad protected exe in PEiD (v0.91) and use the Generic OEP Finder to locate the OEP, write it down.
2. Load the exe in Olly.
3. Right-click the value in ECX and Follow in Dump.
4. Right-click the 01 at 7FFDF002 and fill with 00's.
5. Press Ctrl-G while still in the Dump window and fill in the OEP found in PEiD.
6. Right-click the first byte and Breakpoint Memory, on write.
7. Press Shift-F9 a few times until you break at the BP you just set.
8. Press F8 once and notice how the first byte in the dump changes to 55.
9. Remove the current BPM and set a new one on Breakpoint Hardware, on execution at the 55 (push ebp).
10. A few more Shift-F9's and you're at the OEP.
11. Dump with OllyDump plugin and make sure Rebuild Imports - Method 1 is selected.
12. That's it, enjoy.

CrYpT
March 17th, 2004, 09:08
I tried this way you say, but after I have unpacked it, then it won't start the unpacked exe. I think it is Ollydump there do something wrong, don't you have any problems?

SvensK
March 17th, 2004, 18:02
Nope. Try dumping with LordPE and rebuild IAT with ImpRec instead then.

LibX
March 26th, 2004, 05:54
Try the PEiD generic unpacker works in some cases (NOT ALL!!)

regards
LibX

ChaosLord
June 4th, 2004, 19:48
Any other way to find the OEP, Svensk?


SvensK
June 14th, 2004, 16:20
Ages since I played with it. Don't even remember what target that was for.
I hope you find what you're looking for elsewhere.