PDA

View Full Version : Seems to be another ASprotect Version


SV
October 31st, 2000, 06:22
Hi reversers

Famous AZPR is now 3.51.
It seems that there is a newer (?) ASprotect version.
Not really a problem but needs somes adjustments.

h**p://www.elcomsoft.com/azpr.html

Regards

LuTiN NoIR
November 1st, 2000, 03:47
Hello SV,

I don't look at code of asprotect for this prog just iat and don't see something special (but i don't look at the rest of the code so ...).
I currently coded an import rebuilder and i know you use one too so .. if you look at advanced quicken recovery or office recovery you will look something different on iat ..
But this don't come of asprotect but of compilator. The different part of iat are not separate whith a dword of 0 but whith more dword ... i will added support of this multi part of iat to my rebuilder whith a strange method (give all different iat address) and i want to know if you got a better idea than mine to doing that ?

Regards,
LuTiN NoIR

SV
November 2nd, 2000, 03:47
Hi LuTiN NoIR

I have found these stranges thunks too.
As you said, it's compiler's tricks and i always found enough space to paste uncrypts names.
The paste process with my rebuilder is not automatic, then i can choose where to copy it.
Perhaps the best method will be to add a new section ?

Regards

SV