Results 1 to 2 of 2

Thread: armadillo unpacking problem

  1. #1

    Post armadillo problem

    Hi to all of you, i have a problem while trying to unpack a program that if you want you can find at http://wtf.deleted.com. it seems that it is not compressed but when i break at the eip with mi SICE i found this:
    PUSHAD
    CALL 004F7000 //PROTECTION ENTRY POINT.
    The program detects the debugger with the int 1 method.
    Well, i put a bpmb SetProcessWorkingSetSize x, this breaks two times. I rebuild the IAT and when i run the prg it says that the program has been dameged by avirus or bla.... Now the question is if in your opinion it's a crc check maded by arma or if i have missed the oep. has one of you guru an ? I worked around this prg for weeks but i'm not able to cave a spider from a hole.
    Last edited by fighter_81; January 31st, 2005 at 10:32.
    QUANDO TUTTO SEMBRA PERSO LA VITA CAMBIA VERSO

  2. #2
    i just want to say that i am sorry for posting a direct link to a software. i will never do that again. i promise
    QUANDO TUTTO SEMBRA PERSO LA VITA CAMBIA VERSO

Similar Threads

  1. Help with unpacking armadillo and crypto sections
    By backdoor_b in forum The Newbie Forum
    Replies: 2
    Last Post: February 1st, 2007, 20:02
  2. a question for my first armadillo unpacking
    By Hero in forum The Newbie Forum
    Replies: 1
    Last Post: October 26th, 2005, 20:08
  3. Problems while unpacking armadillo 1.xx-2.xx(PEID said so)
    By ViX in forum OllyDbg Support Forums
    Replies: 31
    Last Post: June 2nd, 2005, 03:48
  4. armadillo DUMPING problem
    By afsana in forum Malware Analysis and Unpacking Forum
    Replies: 7
    Last Post: May 7th, 2005, 06:01
  5. Help, unpacking armadillo
    By MeNiA in forum Malware Analysis and Unpacking Forum
    Replies: 7
    Last Post: April 3rd, 2004, 11:31

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •