Thinstall 2.736

http://tuts4you.com/download.php?view.1679

Ted.

Unpacked

http://rapidshare.com/files/33795691/Thinstall_2.736.rar

& smal script

1.no use imprec

Var iat_start

var oep

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#898D48FEFFFF8B55BC6BD214#

cmp $RESULT,0

je quit

mov iat_start,$RESULT

bp iat_start

find eip,#8B854CFFFFFF508B8550FFFFFFFFE0#

cmp $RESULT,0

je quit

mov oep,$RESULT

add oep,D

bp oep

run

bc iat_start

mov iat_start,eax

aval " ИАТ бинарно скопируйте и вставте в дамп на OEP(IAT bynary copy), IAT Start: {iat_star}"

msg $RESULT

run

bc oep

sti

cmt eip,"OEP"

aval " ИАТ бинарнo вставте в дамп,(IAT bynary paste) IAT Start: {iat_start}"

msg $RESULT

ret

quit

"not Thinstall 2.736"

2.By means of ImpRec for those who prefers

Var iat_Rep

var oep

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#0F85D70000008B8D40FEFFFF51#

cmp $RESULT,0

je quit

mov iat_rep,$RESULT

mov [iat_rep],#90E9#

find eip,#8B854CFFFFFF508B8550FFFFFFFFE0#

cmp $RESULT,0

je quit

mov oep,$RESULT

add oep,D

bp oep

run

bc oep

sti

cmt eip,"OEP"

msg "Oep faund IAt fixed"

ret

quit

"not Thinstall 2.736"

For extraction of files from Thinstall 2.736 Unpackme I wrote a script! Can be useful to whom...

Var mod

var _isBad

var addr_dll

var size_dll

var img_dll

gpa "SetEnvironmentVariableA","kernel32.dll"

bp $RESULT

run

bc $RESULT

rtu

mov oep,eip

add oep,6F

bp oep

run

bc oep

sti

find eip,#51E8??????0083C4088B55C4899528FBFFFFC78578FEFFFF00000000C645FC058B8528FBFFFF#

cmp $RESULT,0

je quit

mov mod,$RESULT

bp mod

run

gpa "IsBadWritePtr","kernel32.dll"

mov _isBad,$RESULT

run

l:

bp _isBad

run

rtu

mov addr_dll,eip

add addr_dll,1E

bc _isBad

go addr_dll

mov img_dll,edx

mov size_dll,edx

add size_dll,90

mov size_dll,[size_dll]

aval "Name dll in ebx, damp partial address:{img_dll} , size:{size_dll}"

msg $RESULT

pause

run

jmp l

quit

ret

aval stand for eval its error

aval stand for eval its error

It isn't an error with the original script Pavka posted. When it was posted the forum automatically filtered a few of the words to what you see now. This was fixed some time ago...

Ted.

pavka: damn you like writing scripts

Good job.