Results 1 to 7 of 7

Thread: problem running unpacked file

  1. #1
    n00b
    Guest

    problem running unpacked file

    i have a file packed with telock , i have UNpacked it with two ways.
    1- manually , olly ( dump )
    2- by using unTelock.

    the unpacked file doesnt run if the original one (packed) is not running.
    i should run the packed file 1st , then the unpacked file <-- will work.

    but if i run the unpacked file it will close after 1 second.

    what is going on?
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    Tola
    Guest
    hint: have a look at the telock options
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  3. #3
    ...or search this board... I think I remember what this is... createmutexa...
    Last edited by Manko; April 23rd, 2005 at 04:45.
    // Wish I had more time... But I guess I would still use it for other things than RCE... :)

  4. #4
    n00b
    Guest
    i dont know , but i see no much threads! , i opened packing/unpacking section
    it has 4 threads only
    Showing threads 1 to 4 of 4 , is there a problem ? or its only has 4 threads?

    Manko , what to search? there is nothing lol!
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    Snowski
    Guest
    Change your board settings...there are more than 4 threads...

    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6
    BeatriX
    Guest
    yes, it is the option "mutex" which is surely used as Manko said. The TElock loader creates a mutex and the target test if this mutex exists. If you unpack the file, the loader don't create it and the file unpacked kick you out you just have to break on createmutex... you must find something like this :

    call CreateMutex
    call GetLastError
    cmp eax, ERROR_ALREADY_EXISTS
    jnz Get_Out_Of_Here_If_You_Are_Lucky (it could be a devil routine !! )
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  7. #7
    dmx
    Guest
    also sometimes prog can do some check.. check that name of general exe not changed, not sure but maybe this trick can be exist here..
    I promise that I have read the FAQ and tried to use the Search to answer my question.

Similar Threads

  1. Pointers in unpacked file don't get rebased
    By Darkelf in forum Malware Analysis and Unpacking Forum
    Replies: 11
    Last Post: October 5th, 2011, 05:27
  2. path of a running applet class file
    By Shub-nigurrath in forum Advanced Reversing and Programming
    Replies: 6
    Last Post: July 2nd, 2011, 10:14
  3. OllyICE doesn't create .udd file for an unpacked executable
    By jayoce in forum OllyDbg Support Forums
    Replies: 5
    Last Post: December 17th, 2008, 04:19
  4. unpacked file won't run on win2k
    By Unregistered in forum Malware Analysis and Unpacking Forum
    Replies: 2
    Last Post: October 15th, 2001, 20:18
  5. IDA sig file loading problem
    By Thigo in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: July 1st, 2001, 06:32

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •