Log in

View Full Version : asprotect 2.0x working tut?

Shub-nigurrath
December 1st, 2004, 07:59
searched a lot around but haven't found a really working tutorial on AsProtect 2.0x

Could some1 point me to the right direction to a tut which worked for him..

particularly I'm working on an asprotected dll..


10x in advance!
p0thead
December 2nd, 2004, 11:41
http://www.ech2004.net/tutoriales/Reventando%20el%20ASProtect%202%20alfa%20(by%20DeAtH).rar

mebbe this is a bit helpfull to you...
Hero
January 16th, 2005, 00:21
I don't know,perhaps That's my problem,But I can't get anything.

sincerely yours
XFlorian
January 20th, 2005, 12:25
The link doesn't work. Can you send another?
ZaiRoN
January 20th, 2005, 13:24
Yes, there is an error in the link p0thead gave you but, you can try using: http://www.ech2004.net/tutoriales/

C'mon, go over the appearances
Formal
January 20th, 2005, 13:31
It works, remove the space in 'death'. Unfortunately I don't understand the language.
JMI
January 20th, 2005, 14:02
Because you do not speak or read all languages, the Diety invented something called "online translators." Perhaps you've heard of them? A search on line should find one that can give a fairly good translation of this tutorial.

Regards,
Formal
January 21st, 2005, 03:36
10x, I'll try.
Hero
January 21st, 2005, 08:26
I have translated this tutorial.The main language is Spanish and I used an
online translator,then this tutorial is now ONLY readable.
You can get it from attachement.

sincerely yours
DeAtH HaS cOMe
January 22nd, 2005, 07:18
Hehe this tutorial is a brief essay about aspr 2.x, you can find more in CracksLatinos (http://www.crackslatinos.hispadominio.net), but also in Spanish, so you must learn Spanish! or how to use a traslation tool
RedH@wK
January 22nd, 2005, 07:38
he Death very good your tutorial of Asprotect..te I congratulate

Greetings
DeAtH HaS cOMe
January 22nd, 2005, 14:24
Thanks you Redh@wk!
Morales
January 25th, 2005, 13:42
Good work Death as is usually in you.
nikolatesla20
January 28th, 2005, 12:26
Hm I don't know spanish, and I'm trying to read this tute..does it cover the new "ripped code" or emulated calls in ASProtect 2.x?

For example, I have a program which has the usual IAT redirection, and that's easy to repair, but then some entries in the IAT have been changed from

Code:


jmp dword ptr [xxxxxxxx]


to

Code:


call xxxxxxxx (high mem)


and also some code sections throughout the EXE also contain this high mem call, almost seems like a code ripping.

So, I have this code:

Code:


* Reference To: msvbvm60.EVENT_SINK_Release, Ord:0192h

                                  |

:00404B2A FF25C4114000            Jmp dword ptr [004011C4]



* Reference To: msvbvm60.GetMemStr, Ord:012Fh

                                  |

:00404B30 FF25F0104000            Jmp dword ptr [004010F0]



* Reference To: msvbvm60.PutMemStr, Ord:0135h

                                  |

:00404B36 FF251C114000            Jmp dword ptr [0040111C]

:00404B3C E8BFB4F500              call 01360000  <-- looks ripped 

:00404B41 84E8                    test al, ch

:00404B43 B9B4F500F9              mov ecx, F900F5B4



* Reference To: msvbvm60.EVENT_SINK_GetIDsOfNames, Ord:0193h

                                  |

:00404B48 FF2500104000            Jmp dword ptr [00401000]



* Reference To: msvbvm60.EVENT_SINK_Invoke, Ord:0194h

                                  |

:00404B4E FF254C104000            Jmp dword ptr [0040104C]



* Reference To: msvbvm60.GetMemEvent, Ord:013Fh

                                  |

:00404B54 FF2520124000            Jmp dword ptr [00401220]



* Reference To: msvbvm60.PutMemEvent, Ord:0140h

                                  |

:00404B5A FF25B8124000            Jmp dword ptr [004012B8]


and then the same thing in other parts of the code (other than just the IAT)
Code:


* Reference To: msvbvm60.__vbaChkstk, Ord:00B6h

                                  |

:004226FE E8AD1FFEFF              Call 004046B0

:00422703 53                      push ebx

:00422704 56                      push esi

:00422705 57                      push edi

:00422706 8965E8                  mov dword ptr [ebp-18], esp

:00422709 C745EC40134000          mov [ebp-14], 00401340

:00422710 C745F000000000          mov [ebp-10], 00000000

:00422717 C745F400000000          mov [ebp-0C], 00000000

:0042271E C745FC01000000          mov [ebp-04], 00000001

:00422725 C745FC02000000          mov [ebp-04], 00000002

:0042272C 6AFF                    push FFFFFFFF

:0042272E E8CDD8F300              call 01360000 <-- ripped

:00422733 94                      xchg eax,esp

:00422734 C745FC03000000          mov [ebp-04], 00000003

:0042273B C78524FFFFFF00000000    mov dword ptr [ebp+FFFFFF24], 00000000

:00422745 C7851CFFFFFF0B000000    mov dword ptr [ebp+FFFFFF1C], 0000000B

:0042274F 8D951CFFFFFF            lea edx, dword ptr [ebp+FFFFFF1C]

:00422755 8D4DD0                  lea ecx, dword ptr [ebp-30]

:00422758 E8A3D8F300              call 01360000  <-- ripped here

:0042275D E5C7                    in ax, C7

:0042275F 45                      inc ebp

:00422760 FC                      cld

:00422761 0400                    add al, 00

:00422763 0000                    add byte ptr [eax], al

:00422765 833D24D0460000          cmp dword ptr [0046D024], 00000000

:0042276C 751C                    jne 0042278A

:0042276E 6824D04600              push 0046D024

:00422773 68B0DC4000              push 0040DCB0

:00422778 E883D8F300              call 01360000 <-- more ripping..


I'm thinking this must be the "emulate system calls" option perhaps..

I'm assuming at this time that it's a code rip that then jumps to the right place after calculating (just like VBox and ACProtect).

The good thing is since this is a VB program, the OEP and IAT is insanely simple to restore (heck you can restore the OEP manually if you want, vb only has oep of 2 instructions).

Anyone have more details? I'm still playing with it for now.

-nt20
Js
January 28th, 2005, 15:40
00404B3C E8BFB4F500 call 01360000 <-- looks ripped

when you land on this set a bp write on 00404B3C+1 and all becomes clear.
nikolatesla20
January 28th, 2005, 16:59
Yea I noticed that after that call returns the call has been "rewritten" to go to another high mem location, and that location sets up a pre-code jump into the actual API (it has some ripped code from the api it looks like).

Pretty yucky stuff, but not undefeatable...

-nt20
Pepone
January 28th, 2005, 19:58
1st thanx Hero for translation.
2nd I have serious problem with breaking at IAT writing in this crackme. I followed at 404bc4 MessageBoxA, and set hw bp on write dword (4 bytes) at 40b1c8. Changed exception - checked all, and run app with F9. No hw break at all. Like no bp seted. After restarting app, bp still active, still no break. What I doing wrong ? IsDebuggerPresent is properly hidden of course.
Zero
February 1st, 2005, 00:22
FYI: Some more infos can be found here, not a full tutorial, but some nice screenshots

http://community.reverse-engineering.net/viewtopic.php?t=3486