Puyover
06-26-2009, 01:46 PM
Hi everyone!
I'm trying to unpack a aplication (a game) which is packed into MoleBox 2.5.7
This is the exe: http://blackout-gaming.net/dl/46587f08a54f539091c049006da96a64/Blackout%20RO%20Installer%20%5B0204%5D.exe (You have to install it, and open Blackout RO.exe with OllyDbg)
Here I paste the data that I have got:
1. EP: 003B6B33 + 00400000 = 007B6B33
OEP: 00699EDA - 00400000 = 00299EDA
ImageBase: 00400000
SizeOfImage: 003D0000
Start of IAT: 002B9000 + 00400000 = 006B9000
End of IAT: 006B9000 + 0000065C = 006B965C
Size of IAT: 0000065C
2. First bad entry: 006B90FC -> A4 44 7C 00 -> Blackout.007C44A4
3. Entry which destroy the good entries: "007BE432 MOV DWORD PTR DS:[ECX],EAX"
Well, I fix that entry with a NOP and there are no more bad entries, but when I "get import" with the Import Reconstructor it shows too many invalid entries :S
Some help?
PD: Sorry my bad English <.<
I'm trying to unpack a aplication (a game) which is packed into MoleBox 2.5.7
This is the exe: http://blackout-gaming.net/dl/46587f08a54f539091c049006da96a64/Blackout%20RO%20Installer%20%5B0204%5D.exe (You have to install it, and open Blackout RO.exe with OllyDbg)
Here I paste the data that I have got:
1. EP: 003B6B33 + 00400000 = 007B6B33
OEP: 00699EDA - 00400000 = 00299EDA
ImageBase: 00400000
SizeOfImage: 003D0000
Start of IAT: 002B9000 + 00400000 = 006B9000
End of IAT: 006B9000 + 0000065C = 006B965C
Size of IAT: 0000065C
2. First bad entry: 006B90FC -> A4 44 7C 00 -> Blackout.007C44A4
3. Entry which destroy the good entries: "007BE432 MOV DWORD PTR DS:[ECX],EAX"
Well, I fix that entry with a NOP and there are no more bad entries, but when I "get import" with the Import Reconstructor it shows too many invalid entries :S
Some help?
PD: Sorry my bad English <.<