Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

Featured Replies

Is anyone getting anywhere on this one? I got a readable dump, not yet working. :unsure:

i have a dump too

bt could'tn fix it with imprec ...

it says "cant read memory of the process"

is there anyone else whoz having the same problem ??

Edited by nick_name

var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools :)

var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools :)

thanks pavka, nice work ...

Edited by nick_name

  • Author

Pavka, what OEP do you get? I think your script is wrong because $403B58 is not the OEP :)

The UnPackMe is executed via kernel32.ResumeThread method so don't be tricked in to thinking Pestil EP is real OEP...

Ted.

4271B0 is oep, no problems using old ebfe trick of changing oep byte at WriteProcessMemory, attach with other olly and dump as raw, change back original oep bytes fix vo = rvo and its done, no other rebuilding required.

http://rapidshare.com/files/41159623/dpest.1.0.rar.html

Thanks zako for your knowledge. Here is a little tip when doing this, or things to not forget. You cant dump with Ollydump, and when editing the oep to ebfe, well when finding it, dont forget to take 1000 off your Oep numbers before adding it to where the buffer starts. ;)

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.