Log in

View Full Version : A strip of code in the an UnpackFile


Limee AKA Lamer
September 16th, 2004, 14:04
I have unpacked a file by unpacking tool.
But The unpacking file run error.
As if the file has CRC check.
The file unpacking file name is st.exe in c:\exepath.
here is the code:

00425ED8 PUSH 0
00425EDA PUSH 80
00425EDF PUSH 3
00425EE1 PUSH 0
00425EE3 PUSH 1
00425EE5 PUSH 80000000
00425EEA MOV EAX,DWORD PTR SS:[EBP-8]
00425EED CALL setup.00403858
00425EF2 PUSH EAX ; The point of c:\exepath\st.exe
00425EF3 CALL setup.0040505C ; Thunk to CreateFileA

CreateFileA function
the last parameter is point of c:\exepath\st.exe
Which mean in this code,why Create a file itself?

evlncrn8
September 16th, 2004, 19:13
it opens the file its running from, so it will read the file in and crc it perhaps? and i believe the param in the createfilea there is open_existing, with generic read access so yup looks like a crc, reroute it to c:\exepath\st.bak so it reads the virgin exe, that might pass the crc check

guhuic
September 16th, 2004, 21:05
Send out your document to me
czh263100@163.com