Page 3 of 4 FirstFirst 1234 LastLast
Results 31 to 45 of 51

Thread: Armadillo Goblin

  1. #31
    : Code Injector : nikolatesla20's Avatar
    Join Date
    Apr 2002
    Location
    :ether:
    Posts
    815
    This isn't my thread, but I agree with +Splaj. It looks as tho Zilot requested through PM about the unpacking. Hence the unpacked file does not belong here. Although it's probably too late anyway, that attachment should be removed. It does not show a proper community spirit if one user wishes to work with another via PM and then the other user party makes the private issues public without knowledge or permission of the requesting party.

    Even more so when the knowledge of the unpacking of that particular attachment does not accompany it. In essence it is then a crack and should be removed.

    -nt20

  2. #32
    Musician member evaluator's Avatar
    Join Date
    Sep 2001
    Posts
    1,479
    Blog Entries
    1
    niko, too many decisions?

    maybe easier is ask, if he request?

    **
    EDIT: niko, too much assumptions??
    Last edited by evaluator; January 21st, 2004 at 17:44.

  3. #33
    my new hair style :) +SplAj's Avatar
    Join Date
    Feb 2001
    Location
    Afghanistan, Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria
    Posts
    373

    sorry.....

    Quote Originally Posted by vladimir
    evaluator, my friend, +SPLAJ is slightly more rude then necessary, but, in general, he is right. So, would you please delete your attachment of the unpacked Zilot's tool.

    Yes I was a bit rude. I apologise to the protectionist assholes. They are really very nice ppl with good ideas and r willing to share their work with others for such little money.
    Carve my name into your arm :)

  4. #34
    >you were NOT right when you unpacked ZILOT's dumper

    What right you can unpack other packers!?

    Unpackers are useful source ppl can learn from them.Unpackers are knowlege if you provide source codes.Well did you ppl SHARE YOUR KNOWLEGE? Really doubt that.

    Evibrator

    Writing a tute is sharing knowlege,I totally agree with Splaj
    esther


    Reverse the code,Reverse Your Minds First

  5. #35
    : Code Injector : nikolatesla20's Avatar
    Join Date
    Apr 2002
    Location
    :ether:
    Posts
    815

    DilloDumper source code.

    I know I've waited a while before sharing this, please forgive me.


    Here is the source code for DilloDumper 2.30. It's fairly messy, but its got a lot of comments that should help someone to understand what is going on. Some of the trix used I still use today in my new unpacker code for Arm. One of the reasons it's hard to share this is mainly because I developed it on 3 computers at the same time, so I hope this is the latest rendition , in other words, I'm not sure anymore which computer contains the latest code. But it looks like this was 2.30. 2.30 added "auto IAT" rebuild, so you'll find lots of functions related to doing that.

    The source is NOT clean or very organized, in fact, it's all in ONE file. I know this is bad practice but this was my first unpacker/dumper and my only goal was to learn how to do some things. I've since improved my structures.

    I hope ppl can learn something from this, even tho many already know how to manually unpack and are very skilled, information on writing an unpacker just doesn't exist on the web, it's one of those things you just have to do. Also, most examples of unpackers source on the web are in ASM. There's no real purpose to do this is asm, C is just as fast nowadays. So here is some C code for you MSVC users out there...


    -nt20
    Attached Files Attached Files

  6. #36
    Thank you for sharing your source


    with respects
    esther


    Reverse the code,Reverse Your Minds First

  7. #37
    Zilot,

    Your tool does not work with the file protected by Armadillo require id and code. I tested.

  8. #38
    Mr. x:

    Perhaps you should read from the start of the thread where Zilot described what the tool would do and would not do. He advised it would remove the copy mem portion, nothing more. Why would you even suspect it would solve the problem with versions requiring id and activation code? It was not offered as a "solve all" solution or as a one click solution for those who do not want to do any of their own work.

    Regards,
    JMI

  9. #39
    nikolatesla20 Thanks for sharing your source code
    I lookforward to learning from it

    Best Wishes

    R@dier

  10. #40
    Zilot,
    Your tool does not work with the file protected by Armadillo require id and code. I tested.
    Yup, doesnt work. You have to find out the way to bypass id check. So if you have file with nag generated by Armadillo, you have to press 'continue trial' or whatever to make my tool working.

  11. #41
    equinoxe
    Guest
    Quote Originally Posted by Zilot
    Yup, doesnt work. You have to find out the way to bypass id check. So if you have file with nag generated by Armadillo, you have to press 'continue trial' or whatever to make my tool working.
    Is there a way to bypass the id check or is there a tut for (arm v 3.40)?
    I am working on a prog with no continue trail posibilities..
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  12. #42

    Unhappy Don't Work on Ringtone Converter 4.8.2

    Coding WorkShop update their protecctions ALWAYS

    The AGoblin Loads the Program &..... nothing!!

    The app load, work and exit; the Agoblin not response.

  13. #43
    Quote Originally Posted by tenketsu
    Coding WorkShop update their protecctions ALWAYS

    The AGoblin Loads the Program &..... nothing!!

    The app load, work and exit; the Agoblin not response.

    Agoblin works even with newest armadillo (3.61) downloaded from siliconrealms.com. Dont believe they protected it with older armadillo.

    Two reasons why you can't get working application:

    1. Shareware authors of Coding WorkShop change protection type
    2. It is not copy-mem protection

    Have you reversed older versions of Coding WorkShop. Once upon a time when I did it, there wasnt copy-mem protection.
    Last edited by Zilot; February 28th, 2004 at 07:45.

  14. #44

    I don't think so!

    I have unpacked 6 versions of Ringtone Converter & ALWAYS use the COPYMEM II protection.

    I dont know why this version 4.8.2 is different in many ways ; download, analize & later say something.

  15. #45
    Quote Originally Posted by tenketsu
    download, analize & later say something.
    You think I have nothing to do but to reverse Ringtone Converter ?

    As I see you are expert for this software (you revesed 6 versions), so it wouldn't be hard to review what you did in previous versions and to apply all of that to this one.

    JMI would say "There is a search button here, and if you doubt to someone use it"

Similar Threads

  1. Armadillo 3.75C
    By MrLoGaN in forum OllyScript Plugin
    Replies: 3
    Last Post: January 17th, 2006, 09:06
  2. Armadillo :-)
    By HANDS in forum OllyDbg Support Forums
    Replies: 9
    Last Post: November 16th, 2005, 04:26
  3. Armadillo
    By Jiggy in forum Malware Analysis and Unpacking Forum
    Replies: 9
    Last Post: March 23rd, 2004, 14:13
  4. Armadillo Tut Req. !
    By fifthelement in forum Malware Analysis and Unpacking Forum
    Replies: 32
    Last Post: February 19th, 2004, 09:09
  5. Armadillo 2.61 =(
    By Mega Desperate in forum Malware Analysis and Unpacking Forum
    Replies: 5
    Last Post: November 4th, 2002, 08:37

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •