nick_name
December 31st, 2005, 05:43
(*)peid says : ASProtect 2.0x Registered -> Alexey Solodovnikov
(*)i found the OEP at :
47DA1C PUSH 60
47DA1E PUSH The_Lost.004B2880
47DA23 CALL The_Lost.0047FE30
47DA28 MOV EDI,94
47DA2D MOV EAX,EDI
47DA2F CALL The_Lost.0047CC30
47DA34 MOV DWORD PTR SS:[EBP-18],ESP
47DA37 MOV ESI,ESP
47DA39 MOV DWORD PTR DS:[ESI],EDI
47DA3B PUSH ESI
47DA3C CALL DWORD PTR DS:[4A5098] | kernel32.GetVersionExA
(*)now i dump the file
(*)try to fix with ImpRec
(*)1 invalid import at : rva:000A0EC ptr:00F6D68
(*)after a short tracing, it's found as GetProcAddress
(*)now after FixDump the app wont run !!
(*)the dumped_.exe would try to jmp somewhere at 1140000
which is outside the memory of the exe ...
now could anyone suggest me wht to do next ??
THANK YOU
(*)i found the OEP at :
47DA1C PUSH 60
47DA1E PUSH The_Lost.004B2880
47DA23 CALL The_Lost.0047FE30
47DA28 MOV EDI,94
47DA2D MOV EAX,EDI
47DA2F CALL The_Lost.0047CC30
47DA34 MOV DWORD PTR SS:[EBP-18],ESP
47DA37 MOV ESI,ESP
47DA39 MOV DWORD PTR DS:[ESI],EDI
47DA3B PUSH ESI
47DA3C CALL DWORD PTR DS:[4A5098] | kernel32.GetVersionExA
(*)now i dump the file
(*)try to fix with ImpRec
(*)1 invalid import at : rva:000A0EC ptr:00F6D68
(*)after a short tracing, it's found as GetProcAddress
(*)now after FixDump the app wont run !!
(*)the dumped_.exe would try to jmp somewhere at 1140000
which is outside the memory of the exe ...
now could anyone suggest me wht to do next ??
THANK YOU