脱DLL文件的ASPROTECT的壳(英文)

Web :http://kickme.to/mxbnet

Contact Me : dheeraj_xp@yahoo.com

{Main} | {Index}

Advanced PDF to HTML converter 1.4

Type : PDF to HTML Converter

Protection : Main dll file packed with ASProtect

Tech : Dumping and Fix IAT

Crack :

Here dll file "pdf2html.dll" is packd with ASProtect.We will have to unpack this dll file.

In SICE BPX GETSTARTUPINFOA and run the program.When we break in the dll file module ... look few lines up ... we can see ....

015F:10046F82 55 PUSH EBP -->> REAL EP

015F:10046F83 8BEC MOV EBP,ESP

015F:10046F85 6AFF PUSH FF

015F:10046F87 6838470510 PUSH 10054738

015F:10046F8C 68FC4F0410 PUSH 10044FFC

015F:10046F91 64A100000000 MOV EAX,FS:[00000000]

015F:10046F97 50 PUSH EAX

015F:10046F98 64892500000000 MOV FS:[00000000],ESP

015F:10046F9F 51 PUSH ECX

015F:10046FA0 51 PUSH ECX

015F:10046FA1 53 PUSH EBX

Dumping can be done even after API CALL GETSTARTUPINFOA ...

Dump it using JMP EIP trick ... correct EB FE using WinHex. Use PEditor and

make EP = 46F82

Now just look at the API CALL GETSTARTUPINFOA ... it will be like this :

10047031 CALL [10053070] ----> ASPROTECT TRICK

So IAT of this dll is some where here ...

Use WinHex RAM Editor and open the memory of this dll file.

Goto this address .... we can see a bunch of address ...which

starts from :

10053000 ---> 10053133 = 134

So run ImpRec and pick this dll and enter these values :

RVA = 53000

SIZE = 134

Now click "GetImports" ... we can see two thunks are invaild.

Now click "AutoTrace" ... and we get all APIs validated ...

Now fix dump .... now this dll file is totaly unpacked and will run.

Note : It is seen that while converting pdf to html sometimes the program crashes ... it is a program bug .... not our fault. You can verify it with unpacked dll file.After unpacking this main dll file ... you can torture it in whatever way you like ....hee..

Method 1:

Open unpacked dll file in WinHex.. We can see the nag string ....:

CREATED WITH UNREGISTERED VERSION .... just change this to ...

[HTML COMMENT] this will inhibit nag string ...

（出处：赢政天下整理收藏）

相关文章：

·AZPR3.0的脱壳教程.

相关软件：

→ 特别推荐

→ 热点TOP10

我为人人《《==》》人人为我

关于我们 |

帮助(？)

| 广告服务 |

版权声明 |

商业合作 |

发展历程 |

加盟我们 |

联系我们

Copyright © 1999-2003

winzheng.com All Rights Reserved.

繁体版:由华琦数码技术提供

Powered

by:MeSky.Net