Eskimobob
January 26th, 2005, 02:01
Hello all,
Greetz to all you masters out there of unpacking as this is an art in my opinion.
As a general forum spider, I've already done research on this topic many times and have found that there are many articles out there. It's just that they fall a little short of explaining one thing that I can't seen to understand or grasp.
It may be though I'm doing something that hasn't been done or rather that is just a little different.
I'm trying to unpack a file that has been compressed with aspack 2.12 (as told to me by pied/PE_Tools) and it's not quite working. This file is like a dll.
The steps that I have taken so far is generally speaking:
I've run the file, using both my own dll loading program and another program. Set it to break on access violations. Then when it does, I check the memory, find the code area, and place a breakpoint. After I do that I do a dump and I get this massively large version of the same dll I assume. I can then repair the PE using LordPE but it returns the DLL to *about* the original thing. Of course the DLL knows that something is changed and fails when it is run. I assume something changed and the CRC's are different.
Back to a little before that, I am using Olly and have dumped sucessfully using OllyDump. I also have loaded the DLL using olly's internal loader and have come to the same problem.
The part I don't understand is the part about getting the start adress and the part about repairing the dump. I assume it needs to be repaired although all the tutorials I have found have conflicting advice.
I've done alot of research so please don't kill me for asking such an age old question. I'm a little confused and after many many many hours I have resorted to asking the masters here.
I have read many posts about this including:
hxxp://www.woodmann.net/forum/showthread.php?t=2707
hxxp://www.exetools.com/forum/showthread.php?t=4550
In both cases I must be too much of a noob to really follow or I may be dealing with something a bit different. Either way I can't seem to unpack this for the life of me. Would anyone mind helping?
[Edit - 2]
I did this, over and over again actually. After going and setting the breakpoint I hit a memory access error. [000...0] As shown below. Within 1 step from that I'm out of that module and in another. I return somewhere else. Doing this process over again leads me to more mem errors and nothing that looks like it's the OEP.
Using Lord_PE the OEP is: say 1084673 value. I notice that the start of the file, is indeed 1000000, so the Entry point was set at 84673, with the image base set at 10000000. The problem is after I hit: Rebuild PE, the file I rebuilt still has the protection on it.
Greetz to all you masters out there of unpacking as this is an art in my opinion.
As a general forum spider, I've already done research on this topic many times and have found that there are many articles out there. It's just that they fall a little short of explaining one thing that I can't seen to understand or grasp.
It may be though I'm doing something that hasn't been done or rather that is just a little different.
I'm trying to unpack a file that has been compressed with aspack 2.12 (as told to me by pied/PE_Tools) and it's not quite working. This file is like a dll.
The steps that I have taken so far is generally speaking:
I've run the file, using both my own dll loading program and another program. Set it to break on access violations. Then when it does, I check the memory, find the code area, and place a breakpoint. After I do that I do a dump and I get this massively large version of the same dll I assume. I can then repair the PE using LordPE but it returns the DLL to *about* the original thing. Of course the DLL knows that something is changed and fails when it is run. I assume something changed and the CRC's are different.
Back to a little before that, I am using Olly and have dumped sucessfully using OllyDump. I also have loaded the DLL using olly's internal loader and have come to the same problem.
The part I don't understand is the part about getting the start adress and the part about repairing the dump. I assume it needs to be repaired although all the tutorials I have found have conflicting advice.
I've done alot of research so please don't kill me for asking such an age old question. I'm a little confused and after many many many hours I have resorted to asking the masters here.
I have read many posts about this including:
hxxp://www.woodmann.net/forum/showthread.php?t=2707
hxxp://www.exetools.com/forum/showthread.php?t=4550
In both cases I must be too much of a noob to really follow or I may be dealing with something a bit different. Either way I can't seem to unpack this for the life of me. Would anyone mind helping?
[Edit - 2]
Quote:
| The packed entry point is the instruction PUSHAD. I then put a read breakpoint on the word pointed to by [ESP] and then run.. Aftre the break point, you step over about 5 lines and boom you are at the entry. (Thanks for the Tutorial on this) |
I did this, over and over again actually. After going and setting the breakpoint I hit a memory access error. [000...0] As shown below. Within 1 step from that I'm out of that module and in another. I return somewhere else. Doing this process over again leads me to more mem errors and nothing that looks like it's the OEP.
Using Lord_PE the OEP is: say 1084673 value. I notice that the start of the file, is indeed 1000000, so the Entry point was set at 84673, with the image base set at 10000000. The problem is after I hit: Rebuild PE, the file I rebuilt still has the protection on it.
, 
