iChallengeYou Posted December 24, 2014 Share Posted December 24, 2014 (edited) Hello all, Are you alone too with Christmas like me? And don't know what to do, then i will challenge you all for a new competition. I created a unpackme with selfmade code, so none protector is used, all coded by me. The goal is to find the original entrypoint, or make a running dump. Goodluck and merry xmas 1. Gold: SHADOW785 2. Silver: SmilingWolf 3. Bronze: GIV Note: The unpackme doesn't run in winXP for a unkown reason. iChallengeYou UnpackMe #1.rar Edited December 26, 2014 by iChallengeYou 1 Link to comment Share on other sites More sharing options...
SHADOW_UA Posted December 24, 2014 Share Posted December 24, 2014 Isn't this ASPack? Anyway...iChallengeYou UnpackMe #1_Unpacked.zip 1 Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 24, 2014 Author Share Posted December 24, 2014 Nice work shadow, although it wasn't that hard. You won the gold medal And yes the first layer is aspack to reduce the filesize. Link to comment Share on other sites More sharing options...
GIV Posted December 25, 2014 Share Posted December 25, 2014 (edited) Very easy.Some stolen imports and some double packing......I did not remove useless sections because is Christmas day and i will go in a visit right away (i'm in a quick rush) ....See ya!Attached is ImpRec tree. ichallengeyou unpackme #1_dump_.7ztree.txt Edited December 25, 2014 by GIV Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 25, 2014 Author Share Posted December 25, 2014 Very easy. Some stolen imports ... (i'm in a quick rush) .... Probably you had a very quick rush because there are no stolen imports. Also the file is not unpacked correctly, you just unpacked the first layer which is Aspack for filesize reducing Link to comment Share on other sites More sharing options...
GIV Posted December 25, 2014 Share Posted December 25, 2014 Sure. I will review when i get more time. Was a 3 minutes job. Thank you! Link to comment Share on other sites More sharing options...
GIV Posted December 25, 2014 Share Posted December 25, 2014 Sure.The OEP is: 005F74C0But strange... under XP SP3 your file does not run ( i have unpacked the first layer under 7 X64 and used the ESP stuff).Was my mistake that i have not double checked if is the final OEP not the second protector OEP.Take a look in attach. I have made a video for you. Desktop.7z Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 25, 2014 Author Share Posted December 25, 2014 Yes as I told in the first post for a unkown reason the packed file won't run in winxp, the unpacked does. But thanks for spending time to my challenge Link to comment Share on other sites More sharing options...
GIV Posted December 26, 2014 Share Posted December 26, 2014 OK.I think this will be suitable. ichallengeyou unpackme #1_dump_.7z Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 26, 2014 Author Share Posted December 26, 2014 This time you got the rigth oep, congrats for that , but you modified (or destroyed) the import-table which is not needed, so your dump still not running here. Link to comment Share on other sites More sharing options...
GIV Posted December 26, 2014 Share Posted December 26, 2014 Strange thing.The dump was running fine then.Now it crash.I hate WIN 7. Link to comment Share on other sites More sharing options...
SmilingWolf Posted December 26, 2014 Share Posted December 26, 2014 My try. This is as small as I could get it.iChallengeYou UnpackMe #1_cleanup.7z 2 Link to comment Share on other sites More sharing options...
GIV Posted December 26, 2014 Share Posted December 26, 2014 OK.Changed here: 722500A5toNOP IAT is clean. No more fake imports.Dump is running fine now.Maybe it was better to search for the redirection switch from the beginning. iChallengeYou UnpackMe #1_dump_SCY.7z Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 26, 2014 Author Share Posted December 26, 2014 (edited) Nice job SmilingWolf! Giv, the dump is finally running, so good job But i still do not understand why you touch the imports, i didn't modified/protected the import-table at all. I will edit the first post to rank you, and be ready for the next challenge soon Edited December 26, 2014 by iChallengeYou Link to comment Share on other sites More sharing options...
GIV Posted December 26, 2014 Share Posted December 26, 2014 Or i'm stupid or Win 7 does something strange to imports.If i did not patch that address the imports are going crazy to other locations as it should be.Noticed that to a PEP 5 unpackme also.XP is way better to unpack than 7. Link to comment Share on other sites More sharing options...
GIV Posted December 26, 2014 Share Posted December 26, 2014 Nice job SmilingWolf! Giv, the dump is finally running, so good job But i still do not understand why you touch the imports, i didn't modified/protected the import-table at all. I will edit the first post to rank you, and be ready for the next challenge soon Next time do a unpackme that runs on XP. Link to comment Share on other sites More sharing options...
iChallengeYou Posted December 26, 2014 Author Share Posted December 26, 2014 Next time do a unpackme that runs on XP. Don't blame me, i can't help that you can't handle =>win7 But for the next challenge i hope the xp issue is solved for then. Link to comment Share on other sites More sharing options...
GIV Posted December 28, 2014 Share Posted December 28, 2014 Strange thing:The packed files crash under XP but the unpacked file runs fine.Conclusion:Badly implemented protection. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now