Results 1 to 4 of 4

Thread: VBox 4.3 unwrapping problem

  1. #1
    Xybyre
    Guest

    VBox 4.3 unwrapping problem

    I installed MicroEdge's Visual SlickEdit 6.0a. It's protected with VBox 4.3 (I think). I followed +Tsehp's VBox 4.3 tutorial, but the execution path doesn't follow the same path!

    The tutorial shows execution going to here:
    015F:011604E0 MOV EDX,[EBP-08]
    015F:011604E3 MOV EAX,[EDX+14] <-- get app entry point
    015F:011604E6 MOV [EBP-10],EAX
    015F:011604E9 MOV EBX,[EBP-10] <-- app entry point to EBX
    015F:011604EC JMP EBX <-- jump to real entry point


    But this target doesn't go there. The function with the above code is entered, but there is a jump before it gets to the 'JMP EBX' that goes to the end of the function.

    Everything else in the tutorial matched what I saw, up to that point. Did I do something wrong, or is this target special? I put a 'bpm x' on the 'JMP EBX' line, but that line never gets executed.

    I've gotten the same results with win2k and winme. I used Soft-ICE on win2k and TRW2000 on winme.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Xybyre
    Guest
    I downloaded PerlBuilder, which also uses VBox 4.3. With PerlBuilder, everything goes exactly as explained in the tutorial. So the VBox protection is somehow different with SlickEdit...
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    JohnBlbec
    Guest
    * sorry for my poor English *

    ...but I thought MicroEdge using FlexLM v6.1a. BTW I'm trying to crack Visual SlickEdit 6.0c and for the present I'm unsuccesful ;o( Installation key for v6.0 not working with v6.0c...
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    hello Xybyre,

    Visual SlickEdit v6.0c is protected by VBOX 4.5.
    vsapi.dll is packed. I have not succeed yet. Can't find the OEP of this dll.

    I wonder what I shall pay special attention to when unpacking a DLL. Import table? Export table? or Relocation table?
    Last edited by Solomon; December 20th, 2001 at 05:50.
    :DWARNING: Shareware authors are reading your detailed discussions without paying you!:D

Similar Threads

  1. VBox 4.6.2
    By jabz in forum Malware Analysis and Unpacking Forum
    Replies: 58
    Last Post: November 7th, 2004, 12:39
  2. VBox 4.5 & revirgin... need some help
    By garph0 in forum Malware Analysis and Unpacking Forum
    Replies: 1
    Last Post: July 14th, 2001, 18:39
  3. VBox 4.3 expired
    By eLastx in forum Advanced Reversing and Programming
    Replies: 2
    Last Post: May 5th, 2001, 12:50
  4. Retrieving VBox'ed DLL - Any ideas?
    By zyn\ker in forum Advanced Reversing and Programming
    Replies: 12
    Last Post: January 9th, 2001, 04:36
  5. VBox v4.3 .DLL Help
    By NchantA in forum Advanced Reversing and Programming
    Replies: 10
    Last Post: November 10th, 2000, 06:14

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •