PDA

View Full Version : Unpacking Softwrap just right click!

Teerayoot
07-31-2003, 01:07 AM
Olly is a great debugger on the earth.One day after i decide to unpack some softwrap prog that written using VB,fist i try to dump using Ollydump then rebuild using imprec .It don't work .it seem something wrong.After try in and try out for a while ,i got it.he he i never think why unpacking softwrap is too easy for every unpacking that i made before,just fallow this intruction
First after you click try on softwrap dialog,fire up OllyDbg ,Attact process that u want to unpack(normally it's extention .locked )then Right click on Cpu Window ,select copy all ,then copy to executable and Save to unpacked.exe
It's work great.

Yes Just Right click!
BruceLee
07-31-2003, 02:00 AM
))) Wonderfull )))
Tacman
07-31-2003, 02:12 AM
whe i try to run the unpacked exe I get and error - xtreamlok alert, dll loading problem or debugger detected or integrity violated. Any advice on how to beat this?
Anonymous
07-31-2003, 03:50 AM
mmmhhh, ok, let me see if what I'm following you correctly ...

1) I got UPX and pack notepad.exe with it
2) I start up the packed notepad
3) I attach the running packed notepad with ollydbg
4) I go to the disassembler pane in the CPU window (if necessary I select the correct executable with ALT+e if the packed exe is not show in the disassembler pane) and right click doing copy->select all
5) once all the code is selected I do copy->to file
6) I copy to the file system all the code with an exe extention and run it
7) it should work .... but it doesn't!!!

Did I follow you correctly or not???
With what kind of packer/encrypter did it work for you???
On what operating system are you working on???

JimmyBoy
Anonymous
07-31-2003, 06:16 AM
JimmyBoy: It's obviously not going to work on UPX is it?

To unpack UPX (and most other packers/protectors) you need to find OEP and dump there.
Anonymous
07-31-2003, 06:30 AM
Hello Anonymous ... obviously what is "obvious" to you may not be so "obvious" to me, don't you think????

If every packer needs finding the OEP and fixing the initial jump, what is Teerayoot talking of unpacking then???????


JimmyBoy
yaa
07-31-2003, 07:43 AM
Hello Teerayoot,

what is the extention .locked that you talk about?

Regards,
yaa
Tacman
07-31-2003, 09:05 AM
He's talking about the Softwrap protection. The app exe that is protected has the extension .locked
Anonymous
07-31-2003, 03:06 PM
Hmmm, how can you do that???
When I try this proggie exit with code 0.
You can unpack but later this dump file is impossible to debug?
Anonymous
07-31-2003, 03:20 PM
did you fix pe header after dumping?
BruceLee
08-01-2003, 12:51 AM
Hmmm I don't... but hmmm, I'll check that!
Anonymous
08-03-2003, 01:59 PM
It's impossible. Mission Impossible
You may on this way only remove nag. Program is still protected by softwrap and
contains a lot of SMC!!!
Anonymous
08-03-2003, 05:56 PM
"It's impossible. Mission Impossible "
a 30 sec max job with unpacking softwxxx with 'the other debugger', horses for courses.
Anonymous
08-06-2003, 10:07 PM
what is the executable?
Anonymous
08-06-2003, 10:27 PM
and where's the unpacked.exe?
TBD
08-06-2003, 11:48 PM
this is not an unpacked forum ... so please do not abuse it.