[ Unpackme ] Thinstall 2.736...

[Teddy Rogers]

Thinstall 2.736

http://tuts4you.com/download.php?view.1679

Ted.

[pavka]

Unpacked

http://rapidshare.com/files/33795691/Thinstall_2.736.rar

& smal script

1.no use imprec

Var iat_start

var oep

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#898D48FEFFFF8B55BC6BD214#

cmp $RESULT,0

je quit

mov iat_start,$RESULT

bp iat_start

find eip,#8B854CFFFFFF508B8550FFFFFFFFE0#

cmp $RESULT,0

je quit

mov oep,$RESULT

add oep,D

bp oep

run

bc iat_start

mov iat_start,eax

aval " ИАТ бинарно скопируйте и вставте в дамп на OEP(IAT bynary copy), IAT Start: {iat_star}"

msg $RESULT

run

bc oep

sti

cmt eip,"OEP"

aval " ИАТ бинарнo вставте в дамп,(IAT bynary paste) IAT Start: {iat_start}"

msg $RESULT

ret

quit

"not Thinstall 2.736"

2.By means of ImpRec for those who prefers

Var iat_Rep

var oep

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#0F85D70000008B8D40FEFFFF51#

cmp $RESULT,0

je quit

mov iat_rep,$RESULT

mov [iat_rep],#90E9#

find eip,#8B854CFFFFFF508B8550FFFFFFFFE0#

cmp $RESULT,0

je quit

mov oep,$RESULT

add oep,D

bp oep

run

bc oep

sti

cmt eip,"OEP"

msg "Oep faund IAt fixed"

ret

quit

"not Thinstall 2.736"

[pavka]

For extraction of files from Thinstall 2.736 Unpackme I wrote a script! Can be useful to whom...

Var mod

var _isBad

var addr_dll

var size_dll

var img_dll

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#51E8??????0083C4088B55C4899528FBFFFFC78578FEFFFF00000000C645FC058B8528FBFFFF#

cmp $RESULT,0

je quit

mov mod,$RESULT

bp mod

run

gpa "IsBadWritePtr","kernel32.dll"

mov _isBad,$RESULT

run

l:

bp _isBad

run

rtu

mov addr_dll,eip

add addr_dll,1E

bc _isBad

go addr_dll

mov img_dll,edx

mov size_dll,edx

add size_dll,90

mov size_dll,[size_dll]

aval "Name dll in ebx, damp partial address:{img_dll} , size:{size_dll}"

msg $RESULT

pause

run

jmp l

quit

ret

[NeO]

aval stand for eval its error

[Teddy Rogers]

aval stand for eval its error

It isn't an error with the original script Pavka posted. When it was posted the forum automatically filtered a few of the words to what you see now. This was fixed some time ago...

Ted.

[kaksii]

pavka: damn you like writing scripts

Good job.