[UnPackMe]Enigma Protector 1.55retail _ NotePad

[stockfan]

Hi My Friends

If Any One Unpacked It , Please Write A Tutorial

Go0d Luck

Enigma1.55retail_unpackme_notepad.rar

[LCF-AT]

Hello,

I have not fixed all APIs so you can not load and save a txt file in this china version of notepad.

RegSheme is easy to bypass.

greetz

unpackme_unpacked.rar

[-kNiGhT-]

Here is my fully working Dump, as LCF-AT said, the RegSheme is no Problem!

Unpacked_Notepad.rar

[stockfan]

Thanks friends

How to bypass?writen Tutorial

Edited December 17, 2008 by stockfan

[HSN.C3r]

HWBP on this address:

010D7D9D

And change Z flag , Now Registration is OK

010D7D9D   /74 60		   JE SHORT unpack55.010D7DFF

Edited December 17, 2008 by HSN.C3r

[stockfan]

HWBP on this address:

010D7D9D

And change Z flag , Now Registration is OK

010D7D9D   /74 60		   JE SHORT unpack55.010D7DFF

Thanks

but I hope Obtains the detail

Hopes the reply

[::: - phpbb3 - :::]

to skip Registration window

HWBP on this address

And change Z flag

10DCD6B JE SHORT 010DCD7C

[thisistest]

006FB48 010B07C1 返回到 unpackme.010B07C1 来自 unpackme.01067DF8

堆栈 SS:[0006FE24]=00CFDA88, (ASCII "A debugger is detected on this computer.

Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.

This program will not execute while debuggers are running.")

EDX=010CA201 (unpackme.010CA201)

0006FDEC 01102C38 unpackme.01102C38

0006FDF0 0105DC37 unpackme.0105DC37

0006FDF4 010EDBFC unpackme.010EDBFC

0006FDF8 00000000

0006FDFC 00000000

0006FE00 0006FDF8

0006FE04 00000000

0006FE08 0010000E

0006FE0C 000A5B70

0006FE10 0006FE08

0006FE14 00000001

0006FE18 00CD0480 ASCII "http://www.yourcompany.com/help/"

0006FE1C 00CFDB60 ASCII "Click here for help"

0006FE20 00CFDB40 ASCII "Debugger warning"

0006FE24 00CFDA88 ASCII "A debugger is detected on this computer.

Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.

This program will not execute while debuggers are running."

0006FE28 010D6330 ASCII "OLLYDBG"

0006FE2C 010E85BA unpackme.010E85BA

0006FE30 0006FF88

010CB89C E8 F3DDFCFF CALL unpackme.01099694

010CB8A1 8B03 MOV EAX,DWORD PTR DS:[EBX]

010CB8A3 8B10 MOV EDX,DWORD PTR DS:[EAX]

010CB8A5 FF92 EC000000 CALL DWORD PTR DS:[EDX+EC]

010CB8AB 8B03 MOV EAX,DWORD PTR DS:[EBX]

010CB8AD E8 CA88F9FF CALL unpackme.0106417C

Edited January 12, 2009 by thisistest