hi everybody,

first sorry for my english... can you unpack for me vagcom v4 and vag-com v7 ? because i'm a noob in manual unpacking and tutorial for pc-guard in french not found :s


file: xxxx://rapidshare.de/files/38085149/vcppcg.rar.html
password of rar is: vagpacked

protected: pc-guard 5

thanks

| Сообщение посчитали полезным:

Crack requests:

http://www.exelab.ru/f/action=vthread&forum=10&topic=5986

| Сообщение посчитали полезным:

hi, my request is not for crack it but only unpack it from pc-guard .... i must do an crack request in that case?

| Сообщение посчитали полезным:

PC-Guard v5.xx Unpacking http://tuts4you.com/request.php?1811 by Orthodox

| Сообщение посчитали полезным:

my english is so bad

| Сообщение посчитали полезным:

misterfr
For start of the program the key is necessary?

| Сообщение посчитали полезным:

i have already a keygen for this software but i want only unpack it for translate it in french...

| Сообщение посчитали полезным:

centner writes:
PC-Guard v5.xx Unpacking by Orthodox

i have try this tutorial but not work, software go on exit after 4X Shift+F9 :s

| Сообщение посчитали полезным:

nobody can just unpack "vcppcg\v4 vagcom\VagCom.exe" (no need to crack it) plz ?

| Сообщение посчитали полезным:

misterfr
VagCom unpacked
rapidshare.com/files/78238845/VAG-COMU_.rar
&Script
----------
var code
var csz
var prb
var oep

GMEMI eip, MEMORYBASE
mov prb,$RESULT
dec prb
GMEMI prb, MEMORYBASE
mov prb,$RESULT


GMI eip,CODEBASE
mov code,$RESULT
GMI eip,CODESIZE
mov csz,$RESULT
bpwm code,csz
erun
bpmc
find prb,#618D4424806A00#
cmp $RESULT,0
je quit
mov oep,$RESULT+E
bp oep
erun
sti
cmt eip,"<--OEP"
msg "OEP Faund, dump it & use ImpRec"
ret
quit
msg "Not PCGuard"

| Сообщение посчитали полезным:

vag-com cannot be launched... when i open he do nothing ....

but vagcom in "V4" directory was needed ....

| Сообщение посчитали полезным:

misterfr
Use a script, there all is simple..

| Сообщение посчитали полезным:

look this picture (*).... i think i have a bad oep ! (vagcom in dir "V4")

i never do an unpacking then help me plz

* xxxx:/./images3.hiboox.com./images/5107/dqnyqwm7.jpg


you script do an error on GMEMI eip, MEMORYBASE (no such command)

and that is the script i have used :
/*
////////////////////////////////////////////////////////////////////// ////////////////////////
// PC-Guard 5.0
// Author : Ashraf Cracker
// Email : AshraCracker@hotmail.com
// OS : WinXP Pro, OllyDbg 1.10 Final, OllyScript 0.92
// Check ALL Debugging Exceptions
////////////////////////////////////////////////////////////////////// ///////////////////////
*/
var cbase
var csize
gmi eip, CODEBASE
mov cbase, $RESULT
log cbase
gmi eip, CODESIZE
mov csize, $RESULT
log csize
bprm cbase, csize
run
msg "This is the OEP! Found By Ashraf Cracker"
msg "The File was dumped successfully don't close OllyDbg and try now to Fix IAT with ImportREC"
cmt eip, "<== Original Entry Point"
ret

| Сообщение посчитали полезным:

004470DC 55 PUSH EBP <------oep vagcom in "V4
004470DD 8BEC MOV EBP,ESP
004470DF 6A FF PUSH -1
004470E1 68 38B44600 PUSH VagCom.0046B438
004470E6 68 145E4400 PUSH VagCom.00445E14
004470EB 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
004470F1 50 PUSH EAX
004470F2 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
004470F9 83EC 58 SUB ESP,58
004470FC 53 PUSH EBX
004470FD 56 PUSH ESI
004470FE 57 PUSH EDI
004470FF 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
00447102 FF15 70524600 CALL DWORD PTR DS:[465270] ; kernel32.GetVersion
00447108 33D2 XOR EDX,EDX
0044710A 8AD4 MOV DL,AH
0044710C 8915 E8645100 MOV DWORD PTR DS:[5164E8],EDX
00447112 8BC8 MOV ECX,EAX
00447114 81E1 FF000000 AND ECX,0FF
0044711A 890D E4645100 MOV DWORD PTR DS:[5164E4],ECX
00447120 C1E1 08 SHL ECX,8
00447123 03CA ADD ECX,EDX
00447125 890D E0645100 MOV DWORD PTR DS:[5164E0],ECX
0044712B C1E8 10 SHR EAX,10
0044712E A3 DC645100 MOV DWORD PTR DS:[5164DC],EAX
00447133 6A 01 PUSH 1
00447135 E8 C9760000 CALL VagCom.0044E803
0044713A 59 POP ECX
0044713B 85C0 TEST EAX,EAX
0044713D 75 08 JNZ SHORT VagCom.00447147
0044713F 6A 1C PUSH 1C
00447141 E8 C3000000 CALL VagCom.00447209
00447146 59 POP ECX
00447147 E8 00330000 CALL VagCom.0044A44C
0044714C 85C0 TEST EAX,EAX
0044714E 75 08 JNZ SHORT VagCom.00447158
00447150 6A 10 PUSH 10
00447152 E8 B2000000 CALL VagCom.00447209
00447157 59 POP ECX
00447158 33F6 XOR ESI,ESI
0044715A 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
0044715D E8 6B6A0000 CALL VagCom.0044DBCD
00447162 FF15 30514600 CALL DWORD PTR DS:[465130] ; kernel32.GetCommandLineA
00447168 A3 60AA5F00 MOV DWORD PTR DS:[5FAA60],EAX
0044716D E8 EA730000 CALL VagCom.0044E55C
00447172 A3 CC645100 MOV DWORD PTR DS:[5164CC],EAX
00447177 E8 93710000 CALL VagCom.0044E30F

| Сообщение посчитали полезным:

i have try with this oep and i have same error :s, can you unpack it for me ? i think its better to begin manual unpacking with french tutorial ...

thank you for your help

| Сообщение посчитали полезным:

1
0046512C 7C801EEE kernel32.GetStartupInfoA
00465130 7C812C8D kernel32.GetCommandLineA
00465134 006221BD VagCom.006221BD <--kernel32.ExitProcess
00465138 7C9105D4 ntdll.RtlAllocateHeap
0046513C 7C9179FD ntdll.RtlReAllocateHeap

2
0043C3C8 68 BE000000 PUSH 0BE
0043C3CD E8 505B1E00 CALL VagCom.00621F22 <----decrypt
0043C3D2 ^ 7F 95 JG SHORT VagCom.0043C369
0043C3D4 2AD6 SUB DL,DH

0043C4CA 68 74000000 PUSH 74
0043C4CF E8 4E5A1E00 CALL VagCom.00621F22 <-----crypt
0043C4D4 3C 2B CMP AL,2B
Script for crypt remove
// ?????? ????????? ? ??? (Script to start being on OEP)

Var oep
var f1
var p1
var p2
var chk
var srh

mov oep,eip
mov srh,401000

l1:
find srh,#68????0000E8????1E00# //masck call
cmp $RESULT,0
je end
mov srh,$RESULT+A
mov chk,[$RESULT+8]
and chk,0F
cmp chk,F
jae l1
mov f1,$RESULT
mov eip,f1
mov p1,f1
add f1,A
bphws f1,"x"
run
bphwc f1
fill p1,A,90
find eip,#68????0000E8????1E00#
cmp $RESULT,0
je end
mov p2,$RESULT
fill p2,A,90
jmp l1

end:
mov eip,oep
MSG "Decrypt Suseful"
ret

| Сообщение посчитали полезным:

vagcom in dir "V4" unpacked
rapidshare.com/files/78333287/VagComU_.rar

| Сообщение посчитали полезным:

i think vag-com have another protection because when i launch it then i have no error but he is closed immediately

| Сообщение посчитали полезным:

Is not present there that all ;) is normally started

| Сообщение посчитали полезным:

no on my computer, your dump not work, he nothing do

| Сообщение посчитали полезным:

misterfr ?????:
my request is not for crack it but only unpack it from pc-guard ...

| Сообщение посчитали полезным:

misterfr
try it
rapidshare.com/files/78475104/VagComU_.rar

| Сообщение посчитали полезным:

ok! BIG thank you but wat was wrong ? WHY when i use dumpfile it in win32dasm 8.93 or reshacker(when i save a re compiled) i have again an error (maybe a protection)

| Сообщение посчитали полезным:

misterfr
Try to process file Resource Binder 2.3

| Сообщение посчитали полезным:

PERFECT ! u really really good! ressource binder is a good soft!

i have last 2 question....

1) what the difference are you do betweden this 2 files:xxxx://rapidshare.com/files/78333287/VagComU_.rar(not work) xxxx://rapidshare.com/files/78475104/VagComU_.rar (work) ... (i think only iat build ?)

2) in can you give the v7-vagcom because xxxx://rapidshare.com/files/78238845/VAG-COMU_.rar cannot be launched like you first v4-vagcom

thank you pavka

| Сообщение посчитали полезным:

misterfr ?????:
in can you give the v7-vagcom
There it is used VM! To assort long enough!
It will be easier if you start 1 script that I have written for you, and will make dump on the Yours computer
All will normally work!

| Сообщение посчитали полезным:

misterfr
try it Will work on all OS normally
rapidshare.com/files/78544350/VAG-COMUV7.rar

| Сообщение посчитали полезным:

THANKS A LOT !!!!!!!!!!!!!!!!!!!!!!!!!! u're good!!!!!

| Сообщение посчитали полезным:

pavka writes:
misterfr
try it Will work on all OS normally
rapidshare.com/files/78544350/VAG-COMUV7.rar


lol reeeee, i can't LOAD this file in w32dasm because there are an" do loop "..... can you help me again for this pavka ?

| Сообщение посчитали полезным:

misterfr
I do not use w32dasm Work in IDA

| Сообщение посчитали полезным: