Results 1 to 5 of 5

Thread: Any trick

  1. #1

    Smile Any trick

    Hi,

    Just want to patch the host of an application which is pcoded. I tried to find out the host in string and unicode but nothing found. Its encrypted and only decrypt while running application. I tried to put bp on gethostbyname i got that host in stack.... so now i tried to follow that one in dissambler but it gose into winsock section. So not possbile to make patches out there. Any suggestion or any tool. Which can help in this situtation to patch the host.

    Application is vb

    cheers,

  2. #2
    editing the hosts file?

  3. #3

    Smile

    Thanks for the info. I know about it but i want to patch that link in application. Any idea how to fix that host in application.

  4. #4
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    you could append a stub to the end of the EXE that hooks gethostbyname and redirects it to a hook-function in your stub, and have the PE's entrypoint point to your stub, which then jumps back to the OEP.

  5. #5
    smart_boy
    Guest
    4 VB P-Code , Use VBDecompiler.
    Search the net 4 it.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. How to solve this trick ?
    By linhan in forum Malware Analysis and Unpacking Forum
    Replies: 12
    Last Post: November 9th, 2007, 23:30
  2. Maybe new Azpr trick ?!
    By Nigma in forum Malware Analysis and Unpacking Forum
    Replies: 4
    Last Post: November 3rd, 2002, 21:27
  3. Asprotect trick?
    By banshee in forum Malware Analysis and Unpacking Forum
    Replies: 3
    Last Post: August 17th, 2002, 17:10
  4. Solomon's trick
    By Risotto in forum Malware Analysis and Unpacking Forum
    Replies: 4
    Last Post: June 17th, 2002, 23:32
  5. Alexeys *new* trick ?
    By +SplAj in forum Advanced Reversing and Programming
    Replies: 4
    Last Post: February 26th, 2001, 18:55

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •