xtremex
06-16-2005, 10:20 AM
While merging 2 ntfs partitions pqmagic gave an error and rendered my data inaccesable. I tried a
dousen of data recovery programs and found only one VirtualLab v5 (from binarybiz) that could recreate the tree exactly as it was. Others miss a lot of files, that's because have a linear approach of recreation and rely mostly on MFT. If this gets corrupted, like in my case, you are
likely to be unable to recover most of your data.
Only one came close VirtualLab capabilities, that beeing File Scavenger v3.01. Please dont suggest me any new recovery software. I tried many as I said before. A crack for VirtualLab would resolve my problem completly. I'm sure of it because the file system tree looks exactly the same as it was (in depth). I can preview images or files to see if they got corrupted, and they are fine.
I'm not to good at cracking, because I don't know much about how different compilers generate asm code (i.e OOP), nor much about assembly. I cracked many programs that needed just a jmp modified or noped instructions (that's easy if you set breakepoint right looking at string resources and code that references them),but not all the software is so easy to crack, and when you really need to understand how a program works, and reverse it, you ought to know more than that. That's why I ask somebody to take a look at it and possibly crack it.
You can download or find information about it here
http://www.binarybiz.com/vlab/index.php
> http://www.binarybiz.com/vlab/downloads/virtuallab.zip
This is an explaination about it's use:
I does NOT have serial (key) to unlock full capabilities.
It's basicaly a client software. If you want to actualy recover data you MUST be online.
While not online you can analize, save recovery state (analilization state), look at result,
or preview individual files (some image file formats are displayed as images).
You need to have an account with them and buy recovery quota. You can recover only within
the limits of the quota you bought (they provide free amounts, samples of free quoata only to
already registered users)
You need to be logged in to start recovering. (It has login button upper right corner). That
means you need to have a valid account to recover.
This is what I could found about how it works by looking at disassembly:
Compiler Delphi 5 (VMT Style D4). The exe is not protected by any packers (protectors).
It uses a Share Memory replacement ShareMemRep v1.51
download location http://www.delphipages.com/edit/count.cfm?ID=4166
It uses modules. To recover corrupted hdd or undelete files (VLHDDRecovery.dll located in HDDRecovery subdirectory)
http://www.binarybiz.com//vlab/autoupdate.txt -- update information, modules, etc
Stores recovery state in VCL files in HDDRecovery subdirectory
A session file is created at succesful login, where information about user and quota is stored.
This gets sincronized if you actualy recover something (quota is decresed). Aswell online.
.I wonder if you can fool software that you canceled recovery before save completion, and not update your quota online. Considering you have a payed account already.
Recovery starts by pressing "Save Files". If you are not logged in pressing it opens a https page
to buy quota (https://www.binarybiz.com/vlab/order/windows/v5/?newcustomer=1)
This is where (my guess) the cracking should start. You need to fool software that we are
allready logged in enogh quota is available and the then the normal destination dialog should open,
and start recovering.
"Save Files" button click = event TfrFiles.ProcessButtonClick (important starting point)
"Preview" button click opens TfmViewer form
Tools used to explore (PExplorer v197, Dede v350, IDA v48, OllyDb)
dousen of data recovery programs and found only one VirtualLab v5 (from binarybiz) that could recreate the tree exactly as it was. Others miss a lot of files, that's because have a linear approach of recreation and rely mostly on MFT. If this gets corrupted, like in my case, you are
likely to be unable to recover most of your data.
Only one came close VirtualLab capabilities, that beeing File Scavenger v3.01. Please dont suggest me any new recovery software. I tried many as I said before. A crack for VirtualLab would resolve my problem completly. I'm sure of it because the file system tree looks exactly the same as it was (in depth). I can preview images or files to see if they got corrupted, and they are fine.
I'm not to good at cracking, because I don't know much about how different compilers generate asm code (i.e OOP), nor much about assembly. I cracked many programs that needed just a jmp modified or noped instructions (that's easy if you set breakepoint right looking at string resources and code that references them),but not all the software is so easy to crack, and when you really need to understand how a program works, and reverse it, you ought to know more than that. That's why I ask somebody to take a look at it and possibly crack it.
You can download or find information about it here
http://www.binarybiz.com/vlab/index.php
> http://www.binarybiz.com/vlab/downloads/virtuallab.zip
This is an explaination about it's use:
I does NOT have serial (key) to unlock full capabilities.
It's basicaly a client software. If you want to actualy recover data you MUST be online.
While not online you can analize, save recovery state (analilization state), look at result,
or preview individual files (some image file formats are displayed as images).
You need to have an account with them and buy recovery quota. You can recover only within
the limits of the quota you bought (they provide free amounts, samples of free quoata only to
already registered users)
You need to be logged in to start recovering. (It has login button upper right corner). That
means you need to have a valid account to recover.
This is what I could found about how it works by looking at disassembly:
Compiler Delphi 5 (VMT Style D4). The exe is not protected by any packers (protectors).
It uses a Share Memory replacement ShareMemRep v1.51
download location http://www.delphipages.com/edit/count.cfm?ID=4166
It uses modules. To recover corrupted hdd or undelete files (VLHDDRecovery.dll located in HDDRecovery subdirectory)
http://www.binarybiz.com//vlab/autoupdate.txt -- update information, modules, etc
Stores recovery state in VCL files in HDDRecovery subdirectory
A session file is created at succesful login, where information about user and quota is stored.
This gets sincronized if you actualy recover something (quota is decresed). Aswell online.
.I wonder if you can fool software that you canceled recovery before save completion, and not update your quota online. Considering you have a payed account already.
Recovery starts by pressing "Save Files". If you are not logged in pressing it opens a https page
to buy quota (https://www.binarybiz.com/vlab/order/windows/v5/?newcustomer=1)
This is where (my guess) the cracking should start. You need to fool software that we are
allready logged in enogh quota is available and the then the normal destination dialog should open,
and start recovering.
"Save Files" button click = event TfrFiles.ProcessButtonClick (important starting point)
"Preview" button click opens TfmViewer form
Tools used to explore (PExplorer v197, Dede v350, IDA v48, OllyDb)