Hi everybody!

This time I'm proud to announce a very interesting release, the result of a very long work I did with ThunderPrw! In the recent months I and ThunderPwr patched several apps an approach to patching that allowed us to test and refine what at the end you'll have in your PCs..or better into a series of tutorials of which these are just the first!

What we developed is a complex approach to cracking using Loaders, not only "simple" loaders, but also debugger loaders..

This are the things we are releasing now:

Tutorials:
-Cracking_with_Loaders_Theory_General Approach_and_a_Framework_v10_by_Shub-Nigurrath_ThunderPwr.rar
-Writing_Loader_2_patch_apps_protected_with_AsProtect_1.2x_and_earlier_v10_by_Shub-Nigurrath-ThunderPwr.rar
-Writing_Loader_2_patch_apps_protected_with_AsProtect_2.0__v10_by_Shub-Nigurrath-ThunderPwr.rar

Tools:
-CRCCalculator_10.rar
-OllyDumpTranslatorV10.rar

[1] Cracking_with_Loaders_Theory_General Approach_and_a_Framework
-----------------------------------------------------------------
This tutorial aim is to describe the work we did on loaders, introduce you to the problem and to describe two different approaches to write loaders. We’ll also present a framework we used for several patches which worked well and that you can re-use as you like.
This paper reading requires a little of knowledge of the C/C++ programming language.
We also release with this tutorial a framework written in C++, which can be used to more rapidly write generic and complex loaders for applications.
As a practical examples we will also present an approach to VB applications serial sniffing through loaders..
** This is a very comprehensive 50 pages tutorial we hope will make the point on this argument

[2] Writing_Loader_2_patch_apps_protected_with_AsProtect_1.2x_and_earlier_v10
-----------------------------------------------------------------------------
This tutorial address a target packed with AsProtect 1.2x and shows to you how to write a loader for asprotected programs with version 1.2x.
The interesting thing is that the patch is done without manual unpacking the program, resulting in a lighter distribution of the patch and in a more reliable crack. The shown method works for all programs protected with version 1.2x or earlier of AsProtect. You will no more worry about stolen bytes because they are not useful for the applications patching and we really do not need them, AsProtect will continue managing them for us.
** The tutorial is an application of the theory and framework described in tutorial [1]

[3] Writing_Loader_2_patch_apps_protected_with_AsProtect_2.0__v10
-----------------------------------------------------------------
This tutorial addresses a target packed with AsProtect 2.0 and shows you how to find where the application sets its trial information, how to defeat the nag, and finally write a generic loader for programs protected with AsProtect version 2.0. The approach is the same used for tutorial [2] but the application is more complex and what we'll address is the resetting of the trial time (handled by AsProtect) and the version 2.0 of this protector.
Again this method has been applied to several targets proving its usefulness
** The tutorial is another application of the theory and framework described in tutorial [1] and [2]

CRCCalculator_10
----------------
It's a CRC calculator we adapted from existing sources around and we are providing here for your usage with loaders. It's nothing complex, but save time searching around for something similar..

OllyDumpTranslatorV10
---------------------
Translates the txt file OllyDbg creates as memory dump into their equivalent C structures, to be used to write Loaders. Setup and manual included.


Find the all at http://cracking.accessroot.com

Have phun
Shub-Nigurrath & ThunderPwr

OOOOOooooooooooooooooooo...

Poppy likes

Woodmann

Wow Shub,
Very nice stuff

I release a very simple example to playback music even with your loaders/programs. It's all C this time.

It includes:

a simple main program which only play a music. See main() for details!
a converting utility convertXM2INC (with sources) used to convert a file .XM into it's equivalent .inc (which will be included into the loader): pass it in command line and the .ini equivalent will be saved in same folder.

Using this approach you will not need any external file to redistribute and music will not be easily ripped because it's not included into the program resources..

if used give credits of course!! :agree:

Basexm Player Sources 10 By Shub-nigurrath
http://releases.accessroot.com

have phun!

Any chance there is an asm source for this or something somilar?

afaik MASM sources are already around and there are many, what I didn't find are c sources, that's why we wrote them..

Hi all,
just released version 1.1 of the Cracking_with_Loaders tutorial.

This new version improves a lot the explanation on the HideDebugger API, explaining the theory behind made of TEB and PEB..that's the only section I completely rewrote adding a lot of informations..IMHO it is an interesting argument to understand how advanced debugger hiding works and how to write that code on your own ..

As usual: http://tutorials.accessroot.com

Great job man!! I downloaded v1.0 some days ago, but today I had some time and I began reading the tutorials. I have no experience coding loaders, so your tutorials are very helpful.

Thanks

Hi all,
just release version 1.2 which is a major upgrade.

Version 1.2 - major fixup:
- Corrected a little severe error on sources.
- Added Appendix II with a much more complete debug loader cycle.

I strongly suggest to redownload the whole tutorial and the connected soruces (included) .sorry.

have phun!