ASprotect pulling my leg...

[Dr.Bizar]

Hi. First off i'm glad to be a new member of this forum :)

I've been playing around with some unpacking - gotta learn it somday...

Hope it's okay to mention the target ? (ed. sna: it is not)

I'm somewhat a newb so plz hold my hand with this one... :unsure:
Planing to pop a tutorial ones i'm done. - other newbs will need a hand to.

Here's what i've done so far; I found the EOP using OllyDbg.
EOP at EIP = 0042D5BB => EP = 0002C9BB -- Plz do correct me if this is wrong.

Next i corrected the IAT using ImportReg.
Finaly i REbuilded and fixed EP using LordPE...

NOTHING WORKS... A'm I missing some stolen bytes ? - Don't get it - Gotta hate Adpr...

Thx in advance

Kind Regards Dr.Bizar

[JohnWho]

First of all i would suggest you to remove the link to the target...

You need to describe whats happening when your running your unpacked file, does it crash with the default Windows message or does the program give you a message. Did you change EP loop from EB FE back to 55 8b or whatever bytes located on OEP? Try trace from EP of unpacked file to see where the program crash, maybe ImpRec didn't fix all imports. There so many things that could make your unpacked file not running so you need to describe exactly whats happening...!

JW.