[unpackme] DotFix NiceProtect 3.6

[HSN.C3r]

Hi.

A picture of "Protector options" is added to attached file.

Good Luck.

UnPackMe.rar

[sdy100]

unpacked

Unpacked_Unpackme.rar

[aztecx]

what do we do when we get to a sysenter?

7C90EB8D   |.  0F34					SYSENTER

[Loki]

Use SoftICE

[Apakekdah]

Cool, i still can use my own script to find where the stolen OEP is located.

[BoRoV]

Please, write tutorial.

[::: - phpbb3 - :::]

Signature

[DotFix NiceProtect v3.6 -> * Sign by phpbb3]

signature = 60 BE ?? ?? 40 00 8D BE EB AF FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 61 50 51 74 05 83 C8 ?? EB 02 31 C0 F9 1B C9 EB

ep_only = false

Edited January 4, 2009 by ::: - phpbb3 - :::

[::: - phpbb3 - :::]

Dumped

unpackme_dump_.zip

[WiNeOS]

I'm stuck with this packer... can someone illuminate us with a little tuto?

Greetz

[Aguila]

I'm stuck with this packer... can someone illuminate us with a little tuto?

http://forum.tuts4you.com/index.php?showtopic=19091

Use my 2 scripts to find the vm start and the stolen OEP. After this assemble the OEP somewhere (a code cave would be nice). Use UIF to fix the IAT and make a dump + add the IAT with ImpREC.

The vm loop starts here:

00462191			 55				   PUSH EBP

Script output:

Command  = MOV EAX,0044FA08
--------------------Registers before 1st Call
EAX Value - 0044FA08
ESP Value - 0012FF5C
EBP Value - 0012FF70
--------------------
CALL	 = PUSH UnPackMe.00406564
Command  = MOV EAX,DWORD PTR DS:[450DEC]
Command  = MOV EAX,DWORD PTR DS:[EAX]
CALL	 = PUSH UnPackMe.0044E2F0
Command  = MOV ECX,DWORD PTR DS:[450EC0]
Command  = MOV EAX,DWORD PTR DS:[450DEC]
Command  = MOV EAX,DWORD PTR DS:[EAX]
Command  = MOV EDX,DWORD PTR DS:[44F7DC]
CALL	 = PUSH UnPackMe.0044E308
Command  = MOV EAX,DWORD PTR DS:[450DEC]
Command  = MOV EAX,DWORD PTR DS:[EAX]
CALL	 = PUSH UnPackMe.0044E388
CALL	 = PUSH UnPackMe.00404108

Fix it manually:

PUSH EBP
MOV EBP, ESP
SUB ESP, -10
MOV EAX,0044FA08
CALL 00406564
MOV EAX,DWORD PTR DS:[450DEC]
MOV EAX,DWORD PTR DS:[EAX]
CALL 0044E2F0
MOV ECX,DWORD PTR DS:[450EC0]
MOV EAX,DWORD PTR DS:[450DEC]
MOV EAX,DWORD PTR DS:[EAX]
MOV EDX,DWORD PTR DS:[44F7DC]
CALL 0044E308
MOV EAX,DWORD PTR DS:[450DEC]
MOV EAX,DWORD PTR DS:[EAX]
CALL 0044E388
CALL 00404108

You can guess the 1st 3 OEP commands (standard delphi oep) or search them before the VM loop...