Log in

View Full Version : Asdd


mr. seeQ
March 4th, 2004, 02:45
HI, this is my another stupid program. As you may know every asprotected program has a dll file - main protection mechanism. Which do all dirty things (checks the application integrity, debugger presence,...)
So, if you want to study the Asprotect itself, you need first dump this dll file. After some analyzing of the aspr loader i write ASDD (ASprotect Dll Dumper). This program automaticly dumping this dll. ASDD has PEHeader rebuilding algorithm, so after dumping you may direct load it to IDA.
Must work with all OS and all Asprotect versions since 1.2

crUsAdEr
March 4th, 2004, 03:39
i thought r!sc released his old unaspr source which also dump the dll?

johndoe1
March 5th, 2004, 06:38
mmm,

what i am wondering does this asprotect.dll also have the antiloader protection
thus that it loads the main app via CreateNewProcessA ??

if so

then i would have to write a loader that first patches the asprotect.dll
then patch the main app and i won't have any problems anymore ??

crUsAdEr
March 5th, 2004, 08:41
yep. u can do that

johndoe1
March 5th, 2004, 08:57
Quote:
[Originally Posted by crUsAdEr]yep. u can do that


could you guide me thru that part ?
or is there any good tutor, on how to find / bypass the anti loader protection ???

grtz, JohnDoe1

Uradox
March 7th, 2004, 03:13
Oh it works, wasnt sure i was expecting that :P good job

crUsAdEr
March 7th, 2004, 09:57
johndoe, honestly, i havent touched the lastest aspr... but where do you have problem with?
createprocess? PatchProcess memory? CRC?