PDA

View Full Version : Hasp4 dumped, next what ?


malkocoglu
September 17th, 2001, 03:27
I have 4 executables enveloped with Hasp4
I also got the dongle for them
I dumped all of them by both IczDump
and ATM's dump command...
I also used pesplit/pejoin tools...

Of course the dumped executables dont work without polishing
I have these sections on one of the executables

.text
.rdata
.data
.rsrc
.tls
._textlh
._hext_ha
.protect

I kill the ._textlh , ._text_ha and .protect
I found the OEP and fixed the PE header bu i still cannot run them
When i dissassemble the EXE dumped by ATM
The EXE seems OK except the Entrypoint
I can see the functions EXE calls clearly
And the Flags for the .text is OK
I think I have a problem with the imports section
Cause when i run the EXE, it dies somewhere in 157:BFFxxxxxxx..
But i dont know what to do next...
Any suggestions, starting point, tutorial ?

Thanks in advance...
Malkocoglu...