Jump to content
Tuts 4 You

[unpackme] Pestil 1.0


Teddy Rogers

Recommended Posts

Guest nick_name

i have a dump too

bt could'tn fix it with imprec ...

it says "cant read memory of the process"

is there anyone else whoz having the same problem ??

Edited by nick_name
Link to comment

var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools :)

Link to comment
Guest nick_name
var rgn

var sz

var va

GPA "CreateProcessA","kernel32.dll"

mov va,$RESULT

BP va

run

BC va

rtu

mov va,eip

add va,76

bp va

run

bc va

sti

mov rgn,eax

mov va,eip

add va,16

go va

mov sz,eax

eval " damp partial in LordPe select IntelDump address:{rgn} , size:{sz}"

msg $RESULT

ret

It is better to use PeTools :)

thanks pavka, nice work ...

Edited by nick_name
Link to comment
Teddy Rogers

Pavka, what OEP do you get? I think your script is wrong because $403B58 is not the OEP :)

The UnPackMe is executed via kernel32.ResumeThread method so don't be tricked in to thinking Pestil EP is real OEP...

Ted.

Link to comment

4271B0 is oep, no problems using old ebfe trick of changing oep byte at WriteProcessMemory, attach with other olly and dump as raw, change back original oep bytes fix vo = rvo and its done, no other rebuilding required.

http://rapidshare.com/files/41159623/dpest.1.0.rar.html
Link to comment

Thanks zako for your knowledge. Here is a little tip when doing this, or things to not forget. You cant dump with Ollydump, and when editing the oep to ebfe, well when finding it, dont forget to take 1000 off your Oep numbers before adding it to where the buffer starts. ;)

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...