[Cheraz]

Hi,

I'm looking for a way to get rid of asprotect 1.1b . I would like to analyse a program that is protected by asprotect. Unfortunately i only found programs for aprotect < 1 . Could you give me an advice?

[gr33dy]

I haven't tried it myself but there is a program called "rAD" that may be able to do it: http://protools.reve...packers/rad.zip

Otherwise, this link may be helpful: http://www.ghu.as.ro...tuts/labba1.htm

[belgther]

1)fire up olly.
2)open target program via olly.
3)go to options-debugging options-exceptions. remove everything except memory access violations in kernel32.
4)run the program. it will break. press shift+f9 each time it holds, counting how many times it held before it runs the program. note it.
5)restart the program. run again. press shift+f9, and press it so many times as you counted before -1. because on the last time, you will press shift+f8. I think you got the point.
6)plugins-command line-command line, type TC EIP<900000 and wait. It will hold at the OEP after a short time.
7)You can dump it, then fix your import table with ImpRec, then change the OEP with procdump or LordPE. Mostly, it works. If it quits, then you have to load the stack of the packed program manually.


This works with asprotect 1.2&1.3, but should work with 1.1 as well.

Have fun...

[White Scorpion]

Interesting Belgther, i never really did something with manual unpacking, but it is very interesting to learn :lol:

As for your problem Cheraz, take a look at this site, although in russia, it has some tools available for download, including several unpackers for asprotect.

[Cheraz]

Thanks guys, you're really helpful.

[belgther]

White Scorpion, on Jul 3 2005, 10:31 AM, said:

As for your problem Cheraz, take a look at this site, although in russia, it has some tools available for download, including several unpackers for asprotect.

<{POST_SNAPBACK}>

Well, these asprotect unpackers never worked by me, i tested some of them in windows 98 some years ago. That's the reason why I started manual unpacking.
BTW, you can take a look at hxxp://biw.rult.at . it has god tutorials about this subject, too. I learned the way i mentioned from that site.

[White Scorpion]

biw.rult.at nowadays is reversing.be
i've been a member on that site for about a year now, i haven't visited it since a couple of months ago, but i will asap.

[r4d14t10n]

if u just want to analys it ....u can dump it with programs like ProcDump ... or Win32 Intro ... hmmm if u cant find them ... pm me..

[Slayer666]

Check This:

Break Asprotect

;)

[320X]

exetools web there are many unpackers

belgther, on Jul 3 2005, 02:45 AM, said:

1)fire up olly.
2)open target program via olly.
3)go to options-debugging options-exceptions. remove everything except memory access violations in kernel32.
4)run the program. it will break. press shift+f9 each time it holds, counting how many times it held before it runs the program. note it.
5)restart the program. run again. press shift+f9, and press it so many times as you counted before -1. because on the last time, you will press shift+f8. I think you got the point.
6)plugins-command line-command line, type TC EIP<900000 and wait. It will hold at the OEP after a short time.
7)You can dump it, then fix your import table with ImpRec, then change the OEP with procdump or LordPE. Mostly, it works. If it quits, then you have to load the stack of the packed program manually.


This works with asprotect 1.2&1.3, but should work with 1.1 as well.

Have fun...

really great method, thanks :)