Jump to content
Tuts 4 You

[unpackme] Update Zprotect 1.4.9.0

thisistest

By thisistest
in UnPackMe

 Share

Recommended Posts

LCF-AT

LCF-AT

Posted
Posted

Hi,

so I have just some questions about the HWID & the 3 buttons.So can you translate the message of this 3 button to english?So I also see you have send the working data too but it seems not to working if I change just the HWID and enter the data.So bypassing is easy without the right data but then some parts of the codesection keep encrypted or will wrong

decrypted.So just tell us what the buttons say and whether the data you send us are the right you know the HWID,Name and Key.Thanks.

greetz

thisistest

thisistest

Posted
  • Author
Posted

There can be a group of key

thisistest

thisistest

Posted
  • Author
Posted

I was tested in vmwar

LCF-AT

LCF-AT

Posted
Posted

@ thisistest

So can you make a new UnpackMe without HWID and also with a other app {No Notepad file}?So you can also set all protections on which you can take.

greetz

Keygen_Dr.

Keygen_Dr.

Posted
Posted (edited)

I studied this protector a lil'. And I came across that it's unpacking a dll into memory, then it opens the registration dialog from that dll. I dumped the dll, but OllyDbg could't open it, i didn't have a look at PE of dll, there can be some invalid values.

But i can attach it into forum.

zprotect.rar

Edited by Keygen_Dr.
xuhw

xuhw

Posted
Posted

Through the registration box very easy!Use --OD!

  • Like 1
EvOlUtIoN

EvOlUtIoN

Posted
Posted

it seems to be an interesting one...i try it asap.

  • 1 month later...
thisistest

thisistest

Posted
  • Author
Posted (edited)

Recently encountered Zprotect, help me unpacking, learning to write a article, thanks tuts4you, LCF-AT......, my friend file http://www.plunder.com/ZProtect-v1-4-4-download-1e5644c2eb.htm

GetHardDiskId

0012FED8 |01367A5A 返回到 01367A5A 来自 01369EE4

0012FEDC |001587A0

0012FEE0 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FEE4 |01271E94

0012FEE8 |00000000

0012FEFC |01363959 返回到 01363959 来自 013679C3

0012FF00 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FF04 |00000000

0012FF08 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FF0C |7354E470 msvbvm60.7354E470

0012FF10 |01271E94

00402EFA .- E9 3D342700 jmp system.0067633C

00402EFF 90 nop

00402F00 .- E9 EF332700 jmp system.006762F4

00402F05 90 nop

00402F06 .- E9 91342700 jmp system.0067639C

00402F0B 90 nop

00402F0C .- E9 33382700 jmp system.00676744

00402F11 90 nop

00402F12 .- E9 39382700 jmp system.00676750

机器码：3C30-7D6A-FB9A-FFA3

用户：hehe

注册码：68D1F93F990F51E64A91F3C39235CA92B185

FF 25 18 10 40 00 FF 25 3C 10 40 00 FF 25 2C 10 40 00 FF 25 34 10 40 00

This is to protect ZProtect v1.4.4, vb language

Edited by thisistest
thisistest

thisistest

Posted
  • Author
Posted

[ZProtect v1.4.4 -> Sign by phpbb3]

signature = E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF

ep_only = true

[ZProtect v1.4.6 -> * Sign by phpbb3]

signature = 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? E9 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00

ep_only = false

[ZProtect v1.4.9 -> * Sign by phpbb3]

signature = E8 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 ?? 87 ?? ??

ep_only = false

  • 3 months later...
  • 1 month later...
LCF-AT

LCF-AT

Posted
Posted

@ MOTOR

at the moment I work on a new fast Zprotect unpacker script {all versions + tut}.So if you have some zprotect target then you can send me a PM to make a test.

On the other hand you can also try the zprotect unpacker script by pavka.

greetz

ahmadmansoor

ahmadmansoor

Posted
Posted

@ thisistest : can u provide us with the right key and the HW-ID and name ??!!

thisistest

thisistest

Posted
  • Author
Posted

This unpackme easy!

  • 3 months later...
OrTHo

OrTHo

Posted
Posted

This unpackme easy!

Pls could you prepare a unpacking video for Zprotect 1.4.4? I have another file protectted with it but I am not capable of unpacking it.

LCF-AT

LCF-AT

Posted
Posted

Hi,

1. The key does not work.

2. Use this new key

DC8A-C11E-29F5-5BE5
free
396A905CDD89FE0C2A229223D6D18CD73C387F3B0A3D30B3471D79B587B96C1CC96E

3. Change HWID / then the data input will accepted.

4. Unpack file

----------------------

Here my unpacked file.Unpack level easy so you just need to fix the IAT.No VMed code used.

Test it.

greetz

Zprotect 1.4.9.0_HWID_Bypassed_Unpacked.rar

  • 2 weeks later...
LCF-AT

LCF-AT

Posted
Posted

Hi,

test1 after HWID changing & insert key.

20100520175326.png

Here my UnpackFile of test1.Just test it.

The other SDK file needs some more time to rebuild of the code.Maybe it comes later.

greetz

test1_HWID_Changed_Unpacked_VM_ADDED.rar

thisistest

thisistest

Posted
  • Author
Posted

test1_HWID_Changed_Unpacked_VM_ADDED can run my xp!

estelle

estelle

Posted
Posted (edited) 
hwid: DC8A-C11E-29F5-5BE5username: free
key: 396A905CDD89FE0C2A229223D6D18CD73C387F3B0A3D30B3471D79B587B96C1CC96E

Zprotect1 1.4.9.0.rar

Edited by estelle

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing
×
×
  • Create New...