Results 1 to 4 of 4

Thread: Packed and probably self-checking. Help needed

  1. #1
    rokafeller
    Guest

    Packed and probably self-checking. Help needed

    Hi,
    I'm on a small program which is a "timer" for pc (shut down at certain time).
    You can run it 100 times, then nag appears. I discovered that it places a reg key to take count of # of executions. It also was packed, I unpacked it (PEpacker). Then found the JLE where there's the check of executions and patched. The program runs but.. some functions are altered! for example, it does nothing instead of shutting down at the set time.
    I also tried to repack it after patching.. some functions are back but completely. I think somewhere it checks its length... have you any suggestions?

    Thanx
    rokafeller
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    anka_213
    Guest
    You might try to set write-breakpoint on the code that changes
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    yes, as a matter of factI do have a suggestion, why are you trying to unpack it in the first place? why don't simply make a loader to reverse this JLE in memory and avoid all the self checks?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    Is this program also checking its file on disk? You might have to null those checks too.

Similar Threads

  1. Integrity checking.
    By Zumo in forum The Newbie Forum
    Replies: 2
    Last Post: April 9th, 2012, 00:05
  2. Packed Malware - Double Packed?
    By vect0r in forum Malware Analysis and Unpacking Forum
    Replies: 26
    Last Post: August 7th, 2008, 06:13
  3. checking my ASM
    By tdennist in forum The Newbie Forum
    Replies: 26
    Last Post: November 25th, 2004, 07:57
  4. How Packed files are Packed
    By naides in forum Malware Analysis and Unpacking Forum
    Replies: 3
    Last Post: February 11th, 2004, 23:33

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •