Log in

View Full Version : Aspack 2.12? Maybe...


HellSoul
September 5th, 2004, 12:16
Well, i must say, i got a problem, i have to unpack a dll

first i have opened it with lordpe to write down imagebase, import table ecc ecc, then i noticed 2 sections:
.xpdata and .adata
well .xpdata sure is a rename for .aspack so i noticed the aspack protetion then i opened the dll with PeID and it said Aspack 2.12.

so i tried to unpack it using OllyDBG.

problem is that i noticed that the protection is not necessary an aspack 2.12 indeed after reading many tutorial and trying many approach to find the OEP the results were near to zero if not exactly zero.

i think there is a debug protection that "protects aspack 2.12" in fact when i try to do something with ollydump or ollyscript it gives me a debug error.
i tried the plugin isdebugpresent but, even if it doesn't give any errors, doesn't seem to work well.

the dll is here packed with a self-executable tool
url DELETED

hope someone can help
thanks for reading.

JMI
September 5th, 2004, 12:52
Well it seems that getting help with your reversing project was SO IMPORTANT to you, you just couldn't wait or be bothered to read the FAQ referenced in the BIG RED LETTERS. Had you taken the time to do so, you would have known not to post links to commercial software here. You would also know that we insist that people first attempt to help themselves by searching for answers to their problems both here and on the net before asking questions here.

Aspack2.12 and debugger detection are issues which have been discussed here many times before and that's why there is a "search" button available for you to do some of your own homework on these issues. You can also search the net using something like "aspack2.12 + olly detect" (without the quotes).

Time to do more reading and then report back with the results of your efforts and then ask for hints.

Regards,

HellSoul
September 5th, 2004, 13:50
Well, first i must say sorry for the link
i didn't notice that i couldn't post files from commercial softwares.

please forgive me.

but before opening a new thread i've already searched for about 5-6 days on google (the net) and this forum without finding the answer to my problem.

after the post of JMI i've searched again but always without no result...
please help me

JMI
September 5th, 2004, 16:25
If you first problem is how to prevent the software from detecting Ollydbg, then you need to search here and on the net for ways that software detects Ollydbg. Try using "asprotect + ollydbg detect*" (without the quotes) and read how software detects Ollydbg. The references to asprotect are because it is made by the same company as aspack.

There are 8 threads here which have some discussion of "ollydbg detect." Have you read those? There are 38 Threads here already on aspack unpacking. Have you read those or are you looking just for a canned answer for your particular target?

There are 34 hits on aspack unpacking on the exetools forum:

http://www.exetools.com/forum/search.php?searchid=33174

including several specifically on aspack 2.12, including one titled " Jump to OEP - Aspack 2.12" so I'l finding it a little difficult to understand why you can't find any information to help solve your problem. Perhaps you need more help actually learning "how to search."

Regards,