Hi,
i'm trying to unpack a program i scanned with peid and protection id.
all scanner say its an asprotector packed file, however no unpacker version was able to unpacked
i tried to do it with ollydbg and some asprotector unpacker plugin find it on this forum without success
is it possible for a developper to spoof the packer name or this is a modified version .. ?
here is the executable file http://www.multiupload.com/EQOECFHH82, please take a look

| Сообщение посчитали полезным:

target.exe - ASProtect 2.4 (build 02.26) beta

| Сообщение посчитали полезным:

Thanks SVLab
Is there any ready unpacker for it or i have do it the hard way ?

| Сообщение посчитали полезным:

You can use vnekrilov's scripts to unpack this shit

Or you can give a link to the full program, and somebody will unpack it for you.

-----
SaNX

| Сообщение посчитали полезным:

I have tried vnekrilov's script on ollydbg without success, it end up with "There are stolen code, check IAT data in log window" , here is the log
Script Log Window
Address Message
B82777 freeloc: 00A30000
BB54EA AsprAPIloc: 00BC269C
BB54EA Aspr1stthunk: 004B5F00
BA5FEC SDK stolen code sections = 00000001
BBEA1C Delphi initialization table address 004A6BF0
BBF854 Total API in this Asprotect = 0000000D
BBF854 GetHardwareIDEx 004A7080
BBF854 CheckKey 004A70A0
BBF854 CheckKeyAndDecrypt 004A70B0
BBF854 GetRegistrationInformation 004A70C0
1BF0372 SDK stolen code section address = 01C60000
1BF0372 Address of IAT = 004B584C
1BF0372 RVA of IAT = 000B584C
1BF0372 Size of IAT = 000006D0
1BF0372 Address of OEP = 004A8EEC
1BF0372 RVA of OEP = 000A8EEC

And this is the full program if someone can help http://www.multiupload.com/EQOECFHH82

| Сообщение посчитали полезным:

Unpacked
http://www.multiupload.com/HN1GZB3FAZ

-----
SaNX

| Сообщение посчитали полезным:

well thank you very much SaNX , its unpacked
but the big surprise the app has modified its logic and do not ask for a registration name and serial anymore,
it now use PE_KILL as username and some random serial and exit
i think it detect it was unpacked!!! good protection
by the way, could you please point me on how you have done this ?

| Сообщение посчитали полезным:

))))) now this program thinks, that it's registered. but it also has online check, you can patch it by yourself. Program don't ask registrastion name and key, because it's was ASprotect's feature. After unpacking, there is no code, asking regcode.

-----
SaNX

| Сообщение посчитали полезным: