Posted December 16, 200816 yr Hi My FriendsIf Any One Unpacked It , Please Write A Tutorial Go0d LuckEnigma1.55retail_unpackme_notepad.rar
December 16, 200816 yr Hello,I have not fixed all APIs so you can not load and save a txt file in this china version of notepad.RegSheme is easy to bypass.greetzunpackme_unpacked.rar
December 16, 200816 yr Here is my fully working Dump, as LCF-AT said, the RegSheme is no Problem!Unpacked_Notepad.rar
December 17, 200816 yr Author Thanks friendsHow to bypass?writen Tutorial Edited December 17, 200816 yr by stockfan
December 17, 200816 yr HWBP on this address: 010D7D9D And change Z flag , Now Registration is OK 010D7D9D /74 60 JE SHORT unpack55.010D7DFF Edited December 17, 200816 yr by HSN.C3r
December 17, 200816 yr Author HWBP on this address:010D7D9D And change Z flag , Now Registration is OK 010D7D9D /74 60 JE SHORT unpack55.010D7DFF Thanks but I hope Obtains the detail Hopes the reply
December 17, 200816 yr to skip Registration windowHWBP on this addressAnd change Z flag10DCD6B JE SHORT 010DCD7C
January 12, 200916 yr 006FB48 010B07C1 返回到 unpackme.010B07C1 来自 unpackme.01067DF8堆栈 SS:[0006FE24]=00CFDA88, (ASCII "A debugger is detected on this computer.Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.This program will not execute while debuggers are running.")EDX=010CA201 (unpackme.010CA201)0006FDEC 01102C38 unpackme.01102C380006FDF0 0105DC37 unpackme.0105DC370006FDF4 010EDBFC unpackme.010EDBFC0006FDF8 000000000006FDFC 000000000006FE00 0006FDF80006FE04 000000000006FE08 0010000E0006FE0C 000A5B700006FE10 0006FE080006FE14 000000010006FE18 00CD0480 ASCII "http://www.yourcompany.com/help/"0006FE1C 00CFDB60 ASCII "Click here for help"0006FE20 00CFDB40 ASCII "Debugger warning"0006FE24 00CFDA88 ASCII "A debugger is detected on this computer.Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.This program will not execute while debuggers are running."0006FE28 010D6330 ASCII "OLLYDBG"0006FE2C 010E85BA unpackme.010E85BA0006FE30 0006FF88010CB89C E8 F3DDFCFF CALL unpackme.01099694010CB8A1 8B03 MOV EAX,DWORD PTR DS:[EBX]010CB8A3 8B10 MOV EDX,DWORD PTR DS:[EAX]010CB8A5 FF92 EC000000 CALL DWORD PTR DS:[EDX+EC]010CB8AB 8B03 MOV EAX,DWORD PTR DS:[EBX]010CB8AD E8 CA88F9FF CALL unpackme.0106417C Edited January 12, 200916 yr by thisistest
Create an account or sign in to comment