stockfan Posted December 16, 2008 Share Posted December 16, 2008 Hi My FriendsIf Any One Unpacked It , Please Write A Tutorial Go0d LuckEnigma1.55retail_unpackme_notepad.rar Link to comment Share on other sites More sharing options...
LCF-AT Posted December 16, 2008 Share Posted December 16, 2008 Hello,I have not fixed all APIs so you can not load and save a txt file in this china version of notepad.RegSheme is easy to bypass.greetzunpackme_unpacked.rar Link to comment Share on other sites More sharing options...
-kNiGhT- Posted December 16, 2008 Share Posted December 16, 2008 Here is my fully working Dump, as LCF-AT said, the RegSheme is no Problem!Unpacked_Notepad.rar Link to comment Share on other sites More sharing options...
stockfan Posted December 17, 2008 Author Share Posted December 17, 2008 (edited) Thanks friendsHow to bypass?writen Tutorial Edited December 17, 2008 by stockfan Link to comment Share on other sites More sharing options...
HSN.C3r Posted December 17, 2008 Share Posted December 17, 2008 (edited) HWBP on this address: 010D7D9D And change Z flag , Now Registration is OK 010D7D9D /74 60 JE SHORT unpack55.010D7DFF Edited December 17, 2008 by HSN.C3r Link to comment Share on other sites More sharing options...
stockfan Posted December 17, 2008 Author Share Posted December 17, 2008 HWBP on this address:010D7D9D And change Z flag , Now Registration is OK 010D7D9D /74 60 JE SHORT unpack55.010D7DFF Thanks but I hope Obtains the detail Hopes the reply Link to comment Share on other sites More sharing options...
::: - phpbb3 - ::: Posted December 17, 2008 Share Posted December 17, 2008 to skip Registration windowHWBP on this addressAnd change Z flag10DCD6B JE SHORT 010DCD7C Link to comment Share on other sites More sharing options...
thisistest Posted January 12, 2009 Share Posted January 12, 2009 (edited) 006FB48 010B07C1 返回到 unpackme.010B07C1 来自 unpackme.01067DF8堆栈 SS:[0006FE24]=00CFDA88, (ASCII "A debugger is detected on this computer.Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.This program will not execute while debuggers are running.")EDX=010CA201 (unpackme.010CA201)0006FDEC 01102C38 unpackme.01102C380006FDF0 0105DC37 unpackme.0105DC370006FDF4 010EDBFC unpackme.010EDBFC0006FDF8 000000000006FDFC 000000000006FE00 0006FDF80006FE04 000000000006FE08 0010000E0006FE0C 000A5B700006FE10 0006FE080006FE14 000000010006FE18 00CD0480 ASCII "http://www.yourcompany.com/help/"0006FE1C 00CFDB60 ASCII "Click here for help"0006FE20 00CFDB40 ASCII "Debugger warning"0006FE24 00CFDA88 ASCII "A debugger is detected on this computer.Applications such as WinIce/SoftIce, OllyDbg, TWD could be executing.This program will not execute while debuggers are running."0006FE28 010D6330 ASCII "OLLYDBG"0006FE2C 010E85BA unpackme.010E85BA0006FE30 0006FF88010CB89C E8 F3DDFCFF CALL unpackme.01099694010CB8A1 8B03 MOV EAX,DWORD PTR DS:[EBX]010CB8A3 8B10 MOV EDX,DWORD PTR DS:[EAX]010CB8A5 FF92 EC000000 CALL DWORD PTR DS:[EDX+EC]010CB8AB 8B03 MOV EAX,DWORD PTR DS:[EBX]010CB8AD E8 CA88F9FF CALL unpackme.0106417C Edited January 12, 2009 by thisistest Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now