Cheat Engine

[Symbol]

Hi,

I just started to learn about unpacking and I already unpacked some packers with the help of Lena151's help, from tuts4you, and I unpacked some stuff by myself, but it wasn't protected, just packed to reduce size...

So I'm now trying to unpack ASProtect 1.2 and having troubles with the IAT.
It doesn't look like it redirect the APIs, looks like it changed the whole IAT to another function. (that push <API Address> and ret)

I wonder if there's an easy way of fixing the IAT, I made a little program that fixes it automatically, not perfect though (luckly it fixed all except of 1, which I fixed manually), is there a good tool for fixing the IAT or I have to fix it manually/code something to do it automatically?

Also after I fixed the IAT the program always crashed (too many exceptions...), not sure if I did anything wrong, maybe the IAT wasn't fully fixed, I don't know...

By the way, ASProtect version 1.3 and later found a way around the method of setting a breakpoint when ESP changes?
Then I guess I have to step into/over a lot, don't I?
I tried animating until "push ebp" (usually blocks of code start with push ebp), but it just looped hudreds of times in the same spot, no success finding OEP.

[STN]

Go fuckin find somebody else for help.

[Symbol]

First of all, thanks for your answer.
I made my own tool to fix the IAT manually, but its not very advanced, haha.
Atleast it's working better than I expected.

As for the push ebp, I know that, appearntly not every function starts with push ebp.
And I know it's not related to the OEP, its just that I didn't see that the packer pushed ebp anywhere, so I assumed the first time I'd see push ebp would be at the entry point.

Well, for the ESP change, I set hardware breakpoint on access and it still got around it without breaking.

And yeah, I tried unpacking an old client of MapleStory (Ahh, forgot the name, wasn't themida though) and it looks impossible to me.
I guess I could search for SunBeam's topic about unpacking MapleStory and check the script, see how it works.

I guess I'll just try doing it all over again, see if I did anything wrong.

Thanks again.

Edit 10000000:
I managed to unpack, I just figured out that it doesn't fix the IAT if some pointers are unresolved, not sure if it should fix and its just a bug or it just doesn't fix if there are unresolved pointers, but I somehow found out that it was GetProcAddress, so I fixed it manually and it worked!

Now I tried ASProtect 1.32, it says there are no unresolved pointers but still doesn't say "Congratulations, bla bla bla, will it work?"
And it really doesn't work, even though it says there are no unresolved pointers, it still says there are invalid. (when I click "show invalid" it highlight some of the pointers, even those that points to an API and not the the packer's code)

[Flyte]

ImpRec should (and always has for me) fix all imports if you play with the settings and use the different functions. Also, the plugins for ImpRec help a lot.

[STN]

Go fuckin find somebody else for help.

[Symbol]

[Flyte]

I just thought I should add that there are a few plugins that every unpacker should have in their arsenal.

1) Phant0m 1.3 (Freezes my computer every so often...)
2) Olly Advanced (Great)
3) ODbgScript (Olly Script)
4) AnalyzeThis (Just handy)

[STN]

Go fuckin find somebody else for help.

[samuri25404]

[STN]

[GMZorita]

[samuri25404]

[atom0s]

Ok going to jump in here and give everyone a verbal warning. Keep this on topic. Someone posted some suggestions for stuff to help, thats not going off topic, that is adding onto the subject at hand. No need to throw words at each other because someone else suggests something.

Get back onto the subject, keep it clean, or warnings will be issued and the topic will be locked.

[STN]

No, all Flyte was trying to do was getting involved in the topic some way and he did it quite smartly. Posting about plugins and tools which if Symbol is serious about unpacking, should already have them. Its like telling somebody "Hey, Get OllyDbg, its fuckin great for debugging" while the guy is having problems reversing an algorithm, ofcourse fuckhead...he knows about olly and is using it.

Your post shows your complete lack of knowledge about the subject, Imprec and all the plugins he posted doesn't fuckin help you in resolving the Import protection. Hell there are no plugins for Imprec that resolves it auto for you so i dont get how the fuck Flyte posts helped him. I really suggest Googling those tools and learning what they do, they in no way have to do anything with Import Fixation.

Well i dont care what Flyte has proved himself but you have proved yourself to be an asshole of Flyte, now i can understand why you are defending him so much.

And whether or not, Flyte offends by my posts, its not your business, well maybe it is arsehole.


Heh seems my decision to join this forum was a bad one, but meh we all take wrong decisions. I am leaving forever this stupid shitheads filled place. have fun sucking eachother ducks.


PS: i edited my posts, now lets see if Flyte with all his mighty knowledge of plugins and fasm can help him. Feel free to edit my posts Wicc, i am leaving anyway.

ohh and thanks for derep heh, like i fuckin care .

[Flyte]

I can unpack Themida, along with multiple other protections. Still think I don't know what I am doing?

Good riddance, we won't miss you.