[unpackme] Pestil 1.0

[Teddy Rogers]

Pestil 1.0

http://tuts4you.com/download.php?view.1767

Ted.

[What]

Is anyone getting anywhere on this one? I got a readable dump, not yet working.

[Guest nick_name]

i have a dump too

bt could'tn fix it with imprec ...

it says "cant read memory of the process"

is there anyone else whoz having the same problem ??

Edited July 5, 2007 by nick_name

[pavka]

var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools

[Guest nick_name]

var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools

thanks pavka, nice work ...

Edited July 5, 2007 by nick_name

[Teddy Rogers]

Pavka, what OEP do you get? I think your script is wrong because $403B58 is not the OEP

The UnPackMe is executed via kernel32.ResumeThread method so don't be tricked in to thinking Pestil EP is real OEP...

Ted.

[zako]

4271B0 is oep, no problems using old ebfe trick of changing oep byte at WriteProcessMemory, attach with other olly and dump as raw, change back original oep bytes fix vo = rvo and its done, no other rebuilding required.

http://rapidshare.com/files/41159623/dpest.1.0.rar.html

[What]

Thanks zako for your knowledge. Here is a little tip when doing this, or things to not forget. You cant dump with Ollydump, and when editing the oep to ebfe, well when finding it, dont forget to take 1000 off your Oep numbers before adding it to where the buffer starts.