I'm attempting to unpack a program packed with SVKP 1.3X. I'll walk you through as far as I've gotten. If anyone can make it further, plz lemme know . If you wanna know the target, say here, and i'll give in pm.

Load up in Olly.
From OEP of the packed exe, trace until you reach the first LOOPD.
Several lines below, there should be:

00619051 75 3C JNZ SHORT .0061908F
00619053 803E 00 CMP BYTE PTR DS:[ESI],0
00619056 74 03 JE SHORT .0061905B
00619058 46 INC ESI
00619059 ^EB F8 JMP SHORT .00619053
0061905B 46 INC ESI
0061905C ^E2 E3 LOOPD SHORT .00619041

As you can see, it is testing for the common cracking tools, so NOP out the JNZ.

Go to Options -> Debugging Options -> Events Tab and check
break on new module

Allow the program to run. Continue hitting F9 until another Entry Point Alert
box pops up. Hit OK. Then hit the Memory Map button ( M ). Find the target
and on the section below the PE HEADER of your target, put a breakpoint on
memory access. F9 again and you should break at or near the OEP. Locate your
OEP, write its address down and restart the app in Olly. Bypass the debug
check again and make it to the Entry Point Alert popup window. Hit ok, and
go to View -> Executable Modules . Double click on your targets exe name
and go to the address for your OEP and set a break point (F2). Hit F9 and you
should break on your OEP. Write down what the first opcode is at your OEP.

Load up LordPE and dump. You will have to use the IntelliDump instead of
the standard LordPE dumper. When I did this, a box popped up and said that
4000h of the 22d000h bytes could not be dumped and would be padded with zeros.
Anyways, I dont think this is a problem... but maybe :/

Start up imprec, enter the OEP, iat autosearch, get imports, show invalid,
trace level 1, show invalid, cut thunks, fix dump.

The intellidump left an int3 at my OEP, so, replace that with the opcode you
wrote down. Now, the program should appears fully unpacked, but it still
crashes, this is where I'm stuck. If anyone has any ideas, please get back
to me.

thanks,
mMhCkB

[Unnecesary personal comment deleted by JMI] read some ricardo tuts like everyone must who can't go on with it.

mmhckb:

There are several things you need to do. First, go to the Links at the bottom of the page and click on the one which states: "Read the FAQ." That will tell you what you are supposed to do before you jump in with a post here.

Second, you are NOT supposed to post target specifically identified code here. You may not have "named" the target, but you, evertheless "identified" the target by leaving it's "name" in the code you posted. I have removed the name of the target from that part of your post. If you want to identify the target, do so in PM and/or email with people who may ask, as you offered, but also make sure you don't leave it showing in your code snippet.

Third, had you read the FAQ, you would know that one of the things you are supposed to do before you post is to do a search for your topic and determine whether your topic may have been discussed before. There is a search button at the top of all the Forums. Although you may have actually done this, there is no way to determine that you have.

Had you put "SVKP" in it you would have found a number of threads discussing that topic, including one titled "how to unpack the shell of svkp 1.3x." That thread would have also referred you to a thread on the exetools forum which also discussed in some detail approaches to this protection system.

The point of this is that it should not be necessary for someone to reinvent the wheel for you because you didn't take the time to do some initial work on your own about your question. If you take that time, you can then ask a more pointed question and include the type of information described in the FAQ about your OS and tools used, although these last were identified.

You were obviously following some tutorial, or at least it appears so. If you successfully unpacked the protected exe and it still crashes, there is a good chance there is an error in your rebuilt IAT. One helpful bit of information for those familiar with this protection would be more information about the "crash." Details about that might help identify the problem. Did you, by any chance, attempt to trace the program in your debugger to the point where it crashed? Or did you just click on it, it crashed, and you gave up the investigation?

For example, one of the exetools threads, hxxp://www.exetools.com/forum/showthread.php?s=&threadid=3088
reported a crash after fixing and dumping and reported that person actually traced the program and found a call to:

Managed to Track where the Dump is Crashing, its because of this:

code:--------------------------------------------------------------------------------
004402C4 A1 682B6200 MOV EAX,DWORD PTR DS:[622B68]
004402C9 . 0BC0 OR EAX,EAX
004402CB . 74 02 JE SHORT dumped1_.004402CF
004402CD . FFE0 JMP EAX
004402CF > 68 AC024400 PUSH dumped1_.004402AC
004402D4 . B8 60114000 MOV EAX,<JMP.&msvbvm60.DllFunctionCall>
004402D9 . FFD0 CALL EAX
004402DB . FFE0 JMP EAX
--------------------------------------------------------------------------------


the function and dll its trying to call ?

non other than ---->

SVKP_Killdebugger
SPECIAL.DLL
--------------------------------------------
You might want to see if this is the issue with your program. Again, simply suggesting that you try to help yourself before you ask others to help you.

Regards,

i think his attempt is very good...
so... :P

keep up the good work mmhckb! ;-)

JMI,
Exactly what constitues an Unnecesary Personal Comment? I have a habit of making sarcastic remarks, and would like to know for my personal reference.

:-)

Peace,

Sorry, in this case I don't specifically recall, but it was a comment of a personal nature, directed at the individual, rather than the situation and that is not appropriate, nor generally tolerated here. We generally attempt to tell folks what they should have done, rather than just "carve them a new one", if you catch my drift.

It generally isn't necessary to point out to someone that they have "no excuse for living and should stop sucking up the good air" to make a, hopefully, useful point that will educate them on how we want them to do what is expected of them here.

Regards,