[unpackme] 12311134

[Teddy Rogers]

12311134 (strange name)

http://tuts4you.com/download.php?view.1815

Ted.

[What]

When I download it and try to open with winrar and 7zip, i get a unexpected end to archive error. Downloaded multiple times.

Edited July 23, 2007 by What

[Teddy Rogers]

Try now...

Ted.

[What]

Working now, Thanks

Edit in: And now working Dump

Edited July 23, 2007 by What

[metr0]

Me, too. Just wondering about the compression ratio - how good is it?

Hehe, just love those code parts:

0046949C	FF15 D8B04600	   call	dword ptr [46B0D8]			; kernel32.IsDebuggerPresent
004694A2	83F8 01			 cmp	 eax, 1
004694A5	75 08			   jnz	 short 004694AF
004694A7	6A 00			   push	0
004694A9	FF15 D0B04600	   call	dword ptr [46B0D0]			; kernel32.ExitProcess

Edited August 17, 2007 by metr0

[SunBeam]

From what PEiD says, it appears to be

bambam V0.04 -> bedrock * Sign.By.fly *

Short tutorial:

- bpm access on .text

- skip the REP instruction with F8

- run again - OEP; then dump

Attached unpacked target

unpacked.zip

Edited August 17, 2007 by sunbeam

[What]

I think this is the one where you just put a breakpoint on the first Ret, Run, Press F7, Dump with rebuild imports checked, works fine.

Edited August 17, 2007 by What