Hey,

Trying to unpack an app packed with asprotect version 2.4 build 02.26
the prog has following options of protections :

- Emulated APIs!
- Damaged table INIT ! Thanks Delphi
- areas of memory with stolen code , SBOEP etc.
- hwid lock

I managed to unpack with vnekrilov's scripts then patch some code and prog works great
except its only useful function witch is located an a separate dll packed with a modified version of upx!
the function should start after a call to Kernel32.CreateThread as show bellow but that thread check for asprotect by polymorphic markers means and just jmp outside

[img]http://i41.tinypic.com/j7dj6g.png[[/img]

According to Asprotect web site :
---------------------------------

["Unprotected application should work incorrectly or should not work at all.
Try to run you application before protection. Does it work normally, does it show empty string 'Registered to:' in the ‘About’ dialog? Then it is a very good help for hackers! At first a hacker tries to remove the ASProtect envelope, it is possible for experienced hackers and it is a common way of removing external protections. A hacker tries to restore the application and get the original EXE file. If you use the encrypted sections and the hacker does not have valid registration keys, getting the EXE file won't help, because the encrypted sections are still encrypted and won't work. But if the hacker has a valid registration key, he can restore the encrypted sections and get the original EXE file"]


Ok, thats the case, i have a valid registration key but not for my hwid so i thought i should find a way to inject the right hwid into memory
and unpack the prog with walid reg key but did not success to trace into gethardwareid call in this target so i start the prog in olly then i checked the
address where the hwid is wrote ,memory breakpoint on access there and restart, after editing the hwid in memory, BOOOOM "Key incorrect" !!!
im sure the key is correct for that hwid (it was mine in my old pc !)

Links to prog with valid key and hwid https://rapidshare.com/files/3217924213/protected.rar
ouuuuuuff, im writing here looking for help.
Thx

| Сообщение посчитали полезным:

Just use PE-Kill's DecompAS.

-----
SaNX

| Сообщение посчитали полезным:

My tool not found envelope checks. The serial number is not accepted, because program used Extended HardwareID. Encrypted only one piece of code. Tomorrow I will try to help you.

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

PE_Kill
Thank you, any progress ?

| Сообщение посчитали полезным:

opengpl Yes

The program is unpacked (ASProtect removed)
ASProtect API emuled with library aspr_api.dll
The encrypted code is deciphered
Checking the serial number on server is disabled (ycrsprot_verify_fix.exe)

I just unpacked the library discern_yah.dll (UPX Mod). Just in case.

Download:
<- links deleted ->

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

PE_Kill Thank you so much , im realy excited

waiting for results

| Сообщение посчитали полезным:

Check previous post

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

PE_Kill Good work but its still protected
Now, it call the dll function but this last harcode a jmp address
to works so if the prog is unpacked we are jumping outside
code.

1295325A E8 00000000 CALL discern_.1295325F
1295325F 58 POP EAX ; discern_.1295325F
12953260 05 7B1D1E83 ADD EAX,831E1D7B ; Here
12953265 0345 10 ADD EAX,DWORD PTR SS:[EBP+10]
12953268 FFE0 JMP EAX ; ouuuups
1295326A 90 NOP


Here is a link https://rapidshare.com/files/1546081163/client.zip to a client app to test with
start the unpacked exe, breakpoint on 12953210, then start runclient.bat

| Сообщение посчитали полезным:

rapidshare shit, upload file to another hosting

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

http://www.2shared.com/file/bfu1aP1p/client.html

| Сообщение посчитали полезным:

opengpl done:

<- links deleted ->

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным:

PE_Kill Thank u so much , you are genius

when u have time, please explain how have u decipher the encrypted code and specially how did u find the right
jmp address. Thanks again

| Сообщение посчитали полезным:

opengpl пишет:
have u decipher the encrypted code
I decompile virtual machine in virtual ASProtect.DLL and correct process of verifying HardwareID. It's not easy to explain.

opengpl пишет:
how did u find the right
jmp address
Meditation and experience

-----
Yann Tiersen best and do not fuck

| Сообщение посчитали полезным: