Jump to content
Tuts 4 You

[unpackme] Starforce Pro 4.50.07.00 (build 29.01.07)


Recommended Posts

Posted

-=[ ProtectionID v6.0 *PRiVATE* ALPHA ]=- © CDKiLLER & [x/xxx]

Build 2007-01-25

> Ready

Scanning -> E:\StarForce 3.xx\protect.dll

File Type : Dll, Size : 4301026 (041A0E2h) Bytes

-> File has 3948770 (03C40E2h) bytes of appended data starting at offset 056000h

[!] Starforce v4.50.07.00 (Build 29.01.07) detected !

[!] [PROTECTiON LEVEL] -> Starforce Professional

- Scan Took : 1.828 Seconds

starforce professional wrapped notepad... haha me wonders if anyone is going to mess around with it.

MaRKuS_TH-DJM
Posted

i can provide you the unpacked exe... it somehow unpacked itself to C:\windows\notepad.exe :P

Posted

MaRKuS_TH-DJM :LOL

it would be nice to really see tut about unpacking it .. but i dont think someone will do it soon...

bye

Posted
it would be nice to really see tut about unpacking it .. but i dont think someone will do it soon...

I doubt anybody will share this kind of knowledge ;)

Cheers

Posted

sometime i can dump that app, sometime i've got error activation, but how to fix invalid thunks ?

Posted

Oh, this is fun. Gotta finish other protections first, then throw meself at this one :)

Posted

how to remove limited execute ?

darn, now this app need activation... :(

  • 2 weeks later...
Posted (edited)

Unfortunately at a cursory glance it appears that none of the more advanced protection options are present here. Just the simple API splicing, which can easily be fixed :(

Edited by rendari
  • 1 month later...
Posted

i can quote my friend "SF 4.5+ is like UPX since they removed many tricks due to compatibility with Vista, 3.5-3.7 was much harder"

Posted

how to reset trial uses ?

Posted

reset trial for starforced notepad...:

1. open registry, go to HKEY_CURRENT_USER\Software, find section with name SF and remove it;

2. go to %systemdrive%:\Documents and Settings\%username%\My Documents and open desktop.ini. Remove all strings after last string beginning with "PersonalizedName=xxxxx"

Posted (edited)

@s0cpy

thx i will try it... ;)

edit : i can unpack, by using attach file not open... how to defeat, activation system ?

Edited by Apakekdah
Posted

have u tried it with IDA? olly sucks for such work

Posted

no... i cant understand if app not running...

can you give me any clue maybe... or tricks ?

thx

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...