[unpackme]SDProtector 1.16

[thisistest]

hi, this is test!

SDProtector All protection options

SDProtector 1.16.rar

[LCF-AT]

Hello,

here my unpacked file.Test it and tell me whether it runs for you or not.

greetz

SDProtector 1.14_Unpacked.rar

[thisistest]

unpacked

can run my xp!

[thisistest]

I think you can write a script for sDProtector1.16

Edited December 9, 2009 by thisistest

[thisistest]

004065C4 - FF25 D0744600 jmp dword ptr ds:[4674D0]

004065CA 8BC0 mov eax,eax

004065CC - FF25 CC744600 jmp dword ptr ds:[4674CC]

004065D2 8BC0 mov eax,eax

004065D4 - FF25 C8744600 jmp dword ptr ds:[4674C8]

004065DA 8BC0 mov eax,eax

004065DC - FF25 C4744600 jmp dword ptr ds:[4674C4]

004065E2 8BC0 mov eax,eax

004065E4 - FF25 C0744600 jmp dword ptr ds:[4674C0]

004065EA 8BC0 mov eax,eax

004065EC - FF25 BC744600 jmp dword ptr ds:[4674BC]

004065F2 8BC0 mov eax,eax

004065F4 - FF25 B8744600 jmp dword ptr ds:[4674B8]

004065FA 8BC0 mov eax,eax

004065FC - FF25 B4744600 jmp dword ptr ds:[4674B4]

00406602 8BC0 mov eax,eax

00406604 - FF25 B0744600 jmp dword ptr ds:[4674B0]

0040660A 8BC0 mov eax,eax

-------------------------------------------------------

00148600 58 pop eax ; SDProtec.0044D25C

00148601 50 push eax

00148602 60 pushad

00148603 9C pushfd

00148604 68 03000000 push 3

00148609 50 push eax

0014860A B8 CFCEABDC mov eax,DCABCECF

0014860F 50 push eax

00148610 B8 9DFA259B mov eax,9B25FA9D

00148615 50 push eax

00148616 E8 0A403900 call SDProtec.004DC625

0014861B 9D popfd

0014861C 61 popad

0014861D B8 9DFA259B mov eax,9B25FA9D

00148622 9C pushfd

00148623 05 CFCEABDC add eax,DCABCECF

00148628 9D popfd

00148629 FFE0 jmp eax

00148628 9D popfd

00148629 - FFE0 jmp eax ; user32.PeekMessageA

EAX 77D1C96C user32.PeekMessageA

ECX 0012FFA8

EDX 0012FF5C

EBX 00000000

ESP 0012FF30

EBP 0012FFA8

ESI 00BD17CC

EDI 0012FF5C

EIP 00148629

----------------------------------------------

00405BB0 - FF25 E4714600 jmp dword ptr ds:[4671E4]

00405BB6 8BC0 mov eax,eax

00405BB8 - FF25 E0714600 jmp dword ptr ds:[4671E0]

00405BBE 8BC0 mov eax,eax

00405BC0 - FF25 DC714600 jmp dword ptr ds:[4671DC]

00145F80 58 pop eax ; SDProtec.00405C85

00145F81 50 push eax

00145F82 60 pushad

00145F83 9C pushfd

00145F84 68 03000000 push 3

00145F89 50 push eax

00145F8A B8 2F267CDB mov eax,DB7C262F

00145F8F 50 push eax

00145F90 B8 829004A1 mov eax,A1049082

00145F95 50 push eax

00145F96 E8 8A663900 call SDProtec.004DC625

00145F9B 9D popfd

00145F9C 61 popad

00145F9D B8 829004A1 mov eax,A1049082

00145FA2 9C pushfd

00145FA3 05 2F267CDB add eax,DB7C262F

00145FA8 9D popfd

00145FA9 FFE0 jmp eax

00145FA9 - FFE0 jmp eax ; kernel32.GetModuleHandleA

EAX 7C80B6B1 kernel32.GetModuleHandleA

ECX 00000002

EDX 00000003

EBX 00463710 SDProtec.00463710

ESP 0128FCF0

EBP 0128FD10

ESI 00000004

EDI 00000005

EIP 00145FA9

---------------------------------------

00147D08 58 pop eax ; SDProtec.0044D2C6

00147D09 50 push eax

00147D0A 60 pushad

00147D0B 9C pushfd

00147D0C 68 01000000 push 1

00147D11 50 push eax

00147D12 B8 F5E584DC mov eax,DC84E5F5

00147D17 50 push eax

00147D18 B8 F68BD177 mov eax,user32.TranslateMessage

00147D1D 50 push eax

00147D1E E8 02493900 call SDProtec.004DC625

00147D23 9D popfd

00147D24 61 popad

00147D25 74 0E je short 00147D35

00147D27 75 0C jnz short 00147D35

00147D29 FF35 481B4100 push dword ptr ds:[411B48]

00147D2F FF20 jmp dword ptr ds:[eax]

00147D1D 50 push eax ; user32.TranslateMessage

EAX 77D18BF6 user32.TranslateMessage

ECX 0000000F

EDX 0012FF5C

EBX 00000001

ESP 0012FF10

EBP 0012FFA8

ESI 00BD17CC

EDI 0012FF5C

EIP 00147D1D

-----------------------------------------------------

00149862 60 pushad

00149863 9C pushfd

00149864 68 04000000 push 4

00149869 50 push eax

0014986A B8 1CF2D6DC mov eax,DCD6F21C

0014986F 50 push eax

00149870 B8 A46407AB mov eax,AB0764A4

00149875 50 push eax

00149876 E8 AA2D3900 call SDProtec.004DC625

0014987B 9D popfd

0014987C 61 popad

0014987D B8 A46407AB mov eax,AB0764A4

00149882 9C pushfd

00149883 35 1CF2D6DC xor eax,DCD6F21C

00149888 9D popfd

00149889 50 push eax ; user32.DispatchMessageA

0014988A C3 retn

EAX 77D196B8 user32.DispatchMessageA

ECX 0012FF5C

EDX 0012FF5C

EBX 00000001

ESP 0012FF40

EBP 0012FFA8

ESI 00BD17CC

EDI 0012FF5C

--------------------

467118 iat start

467708 iat end

---------------------------------

use SDProtector_Pro_1.1x_Redirect Joker_Italy

Invalid Pointer

00467134 7C80999D kernel32.LocalAlloc

00467138 004DAE97 SDProtec.004DAE97

00467164 004DBA24 SDProtec.004DBA24

00467178 004DBA13 SDProtec.004DBA13

00467188 004DB7F0 ASCII "VWj"

004671AC 004DB84B SDProtec.004DB84B

00467270 004DB9D6 SDProtec.004DB9D6

004672B4 004DBA44 SDProtec.004DBA44

004674D8 77D30097 user32.OemToCharA

004674DC 004DB84B SDProtec.004DB84B

0046726C 7C8360F1 kernel32.GlobalAddAtomA

----------------------------

00467130 >7C80993F ?檧| kernel32.LocalFree

00467134 >7C80999D 潤

[thisistest]

my unpacked no run

123_.rar

SDProtect 1.16 script.rar

WSDP116 unpacker.rar

[LCF-AT]

Hi,

@ thisistest

so the reason why your unpacked file not run is that you have a dirty dump!So this happend if you dump

A.] if the target is alraedy running

or

B.] if alraedy is executed to much code after the real OEP

------

Solution: - dump the next time near at the OEP or just cleanup your alraedy dumped dirty file

So if you dump a running target then all is alraedy executed and in your codesection there are also filled addresses with some memory addresses like this part...

00464258  00BD0358  <----
0046425C  0040703C  ASCII 0A,"EDivByZero"
00464260  00BD0338  <----
00464264  00407094  ASCII 0B,"ERangeError"
00464268  00BD0318  <----
0046426C  004070EC  ASCII 0C,"EIntOverflow"
00464270  00BD02F8  <----
00464274  004071A0  ASCII 0A,"EInvalidOp"
00464278  00BD02C8  <----
0046427C  004071F8  ASCII 0B,"EZeroDivide"
00464280  00BD029C  <----
00464284  00407250  ASCII 09,"EOverflow"
00464288  00BD0278  <---- Must be 00000000 
0046428C  004072A8  ASCII 0A,"EUnderflow"

But this are not the only place which you have to clean.

So your unpacked file is also running on my system but after a cleanup.

Of course I can write a cleanup script but I think its not really needed.Also this unpackme is a easy unpackme so you can also break direct at the OEP in Olly to dump your file.Try one of the 2 methods and then you have a working dump file.

greetz