Results 1 to 6 of 6

Thread: Unpacking Softwrap with .locked and .sw2

  1. #1
    Angstzustand
    Guest

    Unpacking Softwrap with .locked and .sw2

    Hi Guys,

    Yes ive used the search function and as i figured out unpacking this kind of Softwrap Versions seems to be quite easy.

    I also found out that the .locked file is basically the original file missing some Instructions, the .sw2 is the Softwrap License File (How often does app start? etc.) and the Main Exe is the Softwrap Loader packed with Xlok.

    Still i dont really get started with that protector, i think i found the OEP but i cant really put a HW Breakpoint on it, i tried breaking on GetModuleHandleA which breaks twice after clicking "Start Trial", although the .locked file is not yet loaded into memory here.

    Any suggestions for a noob on how to start with that wrapper? I think it shouldnt be too hard if you know how. I just dont really know how to start with it.

    Am i right that Xlok doesnt need to be unpacked because only the loader is protected with it?

    Greetings
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  2. #2
    One interesting method for dealing with this protection is to just let it unwrap itself and run as a process, then simply dump the process and rebuild using LordPE. I've used Windbg (.writemem command) or a program called CProcess to do the memory dump. This assumes that you know the OEP so you can change the EP on your newly dumped and fixed file.


    cheers.
    If at first you don't succeed, you're just about average

  3. #3
    evangelis
    Guest
    Hi,

    I have a soft called NAMEDELETED, and it is protected with Xtreamlok. It has no option for trial on the nag screen. How could I manage to work with it? Please help. I am a newbie so I do not know sı much.

    Greetings.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  4. #4
    evangelis:

    You obviously did NOT READ THE FAQ or you would know both about not listing commercial products names and would know that if you want help here you are REQUIRED to start off telling us what YOU have done to try to help yourself, other than just asking for help "cracking" whatever your target program may be. If you actually want to receive some help, you need to actually READ THE FAQ and follow its directions.

    Regards,
    JMI

  5. #5
    evangelis
    Guest
    I am sorry JMI.
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  6. #6

    hmmm

    I have encountered this software in the newer version (7.x?) using xlok trial. I found it is very similiar to 6.x which have tuts on the inet(3 .swf movies tuts), tuts4all.com has it; very useful. However, it has a different iat procedure and steals some values now as well by converting the stolen data into a new jump table. I simply dump the engines memory patched out its antidebug (crc, and real time check for 0xCC if you are tracing). I let it resolve itself. However, I ran into one small problem, if the table is based on memory address of runtime and recalculated everytime the .exe is run. So, a bit harder to just dump that table memory. For now I will rip out the function that creates the table, and let it load first, then execute the app with the added engine stubs. Also I am writing a script as a seperate solution that should* go through all the stolen calls/values and replace them to their original state. The newer version is a little bit stonger then the 6.x since it doesnt resolve the imports to addr value for every iat entry like it did in the past. Now it does 80% the remaining are hardcoded as a table which hav eto be manually extracted. Ill post my results/solution next week when i get time.

Similar Threads

  1. Sentinel Super pro locked data ?
    By 3axap in forum The Newbie Forum
    Replies: 3
    Last Post: May 31st, 2006, 05:00
  2. How to fool MAC address based node locked licenses??
    By eminemence in forum Off Topic
    Replies: 4
    Last Post: December 17th, 2005, 23:00
  3. Softwrap
    By spiffed in forum The Newbie Forum
    Replies: 16
    Last Post: August 1st, 2005, 16:05
  4. Question about Softwrap
    By cRk in forum The Newbie Forum
    Replies: 15
    Last Post: September 6th, 2004, 09:20
  5. Unpacking Softwrap just right click!
    By Teerayoot in forum OllyDbg Support Forums
    Replies: 15
    Last Post: August 6th, 2003, 22:48

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •