Log in

View Full Version : Aspr Exception Handler Emulation notes


Uradox
July 23rd, 2004, 10:45
A While ago i promised these documents i wrote about aspr's 1.3 exception handeling feature...this feature since hasnt really hit off since theres not a lot of exe's it can protect with this and those it can often crashed (from my tests) I noticed in a app recently there was some code relivant to this handler tho it was not used or complete from what i could tell...
So here those notes are. Somewhat not very well commented but they were written during 'runtime'
How to patch notes dont seem to be around but its really not that hard, when u read the table u just apply a common call/jmp distance calculation to it etc..

I'v lost the table fixer tool alltogether due to a HD failure at the time so if anyone has it (i know i gave it to a few ppl) post it here for those interested.

Sorry if this post has broken any rules i did look in the FAQ breifly.
Now i go back into my nest and hide =)

crUsAdEr
July 23rd, 2004, 18:41
Hi Uradox,

Thanks for the notes but they are more or less old stuff i think... i looked at aspr1.31 and most of these info are irelevant... except some interesting comments you made alongside the codes...

Just wondering where you ripped the code from? The aspr.dll embedded in each protected exe or are some of the code from the original asprotect.exe itself? The current nanomite in aspr is more interesting and subtle, though basically it is still the same as what you describe...

Uradox
July 24th, 2004, 01:22
its from the aspr dll.
Parts are generated per application too so some code i described is not the same in all applications. Newer is simular just small changes in methods for it.. still uses the table still same format from what iv seen but I dont look deeply into it anymore.
Old yes.. it was something i did around nov/dec last year when it surfaced =) thought it may have been of some use for some other ppl.