koyaan
May 25th, 2004, 09:33
okay... im trying to unpack the all seeing eye atm...
upx is pretty straight-forward... i was able to find the oeip, i do a EB FE to
get it in an endless loop, dump it with lordpe then fix the entry point...
i start my dumped exe and... it runs!
now i close it and try to start it again...it crashes
i loaded it in olly and it seems the first call to an api causes the problem...
by comparing the iat of the dumped exe with the original i found that every adress there was off by the same offset... pasted the original into the dumped, but it didnt quite work out, but im quite a newbie when it comes to unpacking / rebuildin...
what really bugs me is that my dumped exe runs once (or even twice) and suddenly refuses cooperation....
ps: i did search for upx on the board ty
cheers koyaan
upx is pretty straight-forward... i was able to find the oeip, i do a EB FE to
get it in an endless loop, dump it with lordpe then fix the entry point...
i start my dumped exe and... it runs!
now i close it and try to start it again...it crashes

i loaded it in olly and it seems the first call to an api causes the problem...
by comparing the iat of the dumped exe with the original i found that every adress there was off by the same offset... pasted the original into the dumped, but it didnt quite work out, but im quite a newbie when it comes to unpacking / rebuildin...
what really bugs me is that my dumped exe runs once (or even twice) and suddenly refuses cooperation....
ps: i did search for upx on the board ty

cheers koyaan