Jump to content
Tuts 4 You

[unpackme] Update Zprotect 1.4.9.0


thisistest

Recommended Posts

Hi,

so I have just some questions about the HWID & the 3 buttons.So can you translate the message of this 3 button to english?So I also see you have send the working data too but it seems not to working if I change just the HWID and enter the data.So bypassing is easy without the right data but then some parts of the codesection keep encrypted or will wrong

decrypted.So just tell us what the buttons say and whether the data you send us are the right you know the HWID,Name and Key.Thanks.

greetz

Link to comment
Share on other sites

@ thisistest

So can you make a new UnpackMe without HWID and also with a other app {No Notepad file}?So you can also set all protections on which you can take.

greetz

Link to comment
Share on other sites

I studied this protector a lil'. And I came across that it's unpacking a dll into memory, then it opens the registration dialog from that dll. I dumped the dll, but OllyDbg could't open it, i didn't have a look at PE of dll, there can be some invalid values.

But i can attach it into forum.

zprotect.rar

Edited by Keygen_Dr.
Link to comment
Share on other sites

  • 1 month later...

Recently encountered Zprotect, help me unpacking, learning to write a article, thanks tuts4you, LCF-AT......, my friend file http://www.plunder.com/ZProtect-v1-4-4-download-1e5644c2eb.htm

GetHardDiskId

0012FED8 |01367A5A 返回到 01367A5A 来自 01369EE4

0012FEDC |001587A0

0012FEE0 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FEE4 |01271E94

0012FEE8 |00000000

0012FEFC |01363959 返回到 01363959 来自 013679C3

0012FF00 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FF04 |00000000

0012FF08 |00403070 ASCII "VB5!6&vb6chs.dll"

0012FF0C |7354E470 msvbvm60.7354E470

0012FF10 |01271E94

00402EFA .- E9 3D342700 jmp system.0067633C

00402EFF 90 nop

00402F00 .- E9 EF332700 jmp system.006762F4

00402F05 90 nop

00402F06 .- E9 91342700 jmp system.0067639C

00402F0B 90 nop

00402F0C .- E9 33382700 jmp system.00676744

00402F11 90 nop

00402F12 .- E9 39382700 jmp system.00676750

机器码:3C30-7D6A-FB9A-FFA3

用户:hehe

注册码:68D1F93F990F51E64A91F3C39235CA92B185

FF 25 18 10 40 00 FF 25 3C 10 40 00 FF 25 2C 10 40 00 FF 25 34 10 40 00

This is to protect ZProtect v1.4.4, vb language

Edited by thisistest
Link to comment
Share on other sites

[ZProtect v1.4.4 -> Sign by phpbb3]

signature = E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF

ep_only = true

[ZProtect v1.4.6 -> * Sign by phpbb3]

signature = 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? E9 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00

ep_only = false

[ZProtect v1.4.9 -> * Sign by phpbb3]

signature = E8 ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? 87 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? ?? E9 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 ?? 87 ?? ??

ep_only = false

Link to comment
Share on other sites

  • 3 months later...
  • 1 month later...

@ MOTOR

at the moment I work on a new fast Zprotect unpacker script {all versions + tut}.So if you have some zprotect target then you can send me a PM to make a test.

On the other hand you can also try the zprotect unpacker script by pavka.

greetz

Link to comment
Share on other sites

  • 3 months later...

This unpackme easy!

Pls could you prepare a unpacking video for Zprotect 1.4.4? I have another file protectted with it but I am not capable of unpacking it.

Link to comment
Share on other sites

Hi,

1. The key does not work.

2. Use this new key

DC8A-C11E-29F5-5BE5
free
396A905CDD89FE0C2A229223D6D18CD73C387F3B0A3D30B3471D79B587B96C1CC96E

3. Change HWID / then the data input will accepted.

4. Unpack file

----------------------

Here my unpacked file.Unpack level easy so you just need to fix the IAT.No VMed code used.

Test it.

greetz

Zprotect 1.4.9.0_HWID_Bypassed_Unpacked.rar

Link to comment
Share on other sites

  • 2 weeks later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...