|
ARTeam Tutorial Visit:
http://cracking.accessroot.com
|
http://forum.accessroot.com Unpacking ASProtect 1.2 / 1.2c And Removing ASPR Time Limit Protection. |
| Information | Unpacking ASProtect 1.2 / 1.2c And Removing ASPR Time Limit Protection. |
| Target | EMS MySQLManager 2.7.0.1 |
| Available | http://ems-hitech.com/mymanager/ |
| Tools | OllyDbg 1.10, ImpRec, LordPE, Hide Debugger, CommandBar Ollyplugin, MapConv Olly plugin by godfather+ |
| Protection | Packed/Decompressed on the fly and AsProtect's nag screen shown at the beginning of the app, with time limit. |
| level | Beginner |
| Category | Unpacking & Patching |
| Author(s) | Ferrari & Shub-Nigurrath July 2004 |
| Requirements | Windows XP, IE 5.5 and above for best viewing |
|
1. Introduction
|
|
Hi all today's target is MySQL Manager which shows which
seems to be a normal time trial limitation. A little
deeper inspection will show us that behind a normal time
limitation there's something more.
The program is packed with a quite old AsProtect
version and there are no stolen bytes at all, as we'll
see but the code responsible for the Nag is placed
directly by AsProtect so removing it on the one hand
becomes a little more complicated than modifying a
conditional jmp, but on the other hand when you'll know
how to do it the same method can be applied to any
AsProtected program.. There are three sections in the
remaining of this tutorial: |
|
2.
Let first look at the program
|
|
The first Step is to look how the program acts. It creates a dialog with a day-count that decreases till you get the nag below.
|
|
3. Finding the
Original Entry point
|
|
As you see there are more ways to defeat ASPR but I will show you how to IP it so that you can use it after the 30 Days evaluation. Also before reading this tutorial do "Strictly" refer this tutorial since we are not going to cover all detail steps like:- LordPE, Imprec etc.
Download: Ok lets begin. Open target in Olly and hit Shift + F9 once. Hit Ctrl+B and enter this byte pattern: 8B 17 89 02 (what is usually called Magic Call) and hit OK and land here:
0110F4D5
E8 7EFEFFFF CALL 0110F358 <------------ Put BP here by pressing F2 key Now after setting BP keep pressing Shift + F9 for 15 times and Oll breaks at our BP.
0110F4D5
E8 7EFEFFFF CALL 0110F358 <------------ Olly Breaks here. Now NOP this CALL and hit Shift + F9 once, then hit " - " key and undo the NOP changes and then continue pressing Shift + F9 till you see this code (Last Exception): 0110FC2A 3100 XOR DWORD PTR
DS:[EAX],EAX <------------- Stop when you are here Here we put BP on JMP command becasue it will jump beyond the RETN. In most ASPr targets we put BP on last RETN but in this case it is otherwise. Okay first set the debugging options as in the screenshot below. This is not required in this target but you do use these settings when unpacking ASPR.
After putting BP on JMP hit Shift + F9 once so Olly breaks at BP and then only hit F9 once and land here:
011EF248 FF06 INC DWORD PTR DS:[ESI]
<------------- You land here After putting BP on RETN hit Shift + F9 once so Olly breaks. Now hit Alt + M to open the memory map window and then select click "code" section and clcik on Set Memory Breakpoint access. Now back in main window hit only F9 key once and land at our OEP :-). Another alternative to do the same think is to place a BP at 011EF24C 33DB XOR EBX,EBX and press simply Ctrl + F9 to stop there. When you're stopped at this address press Alt + M as told above and place a memory breakpoint on access in the code section of the program. You'll land at the same OEP (of course, how may OEPs would you like to see in a program :D). This is what you could see now:
00A1B998 55 DB 55 ; CHAR 'U' <---- OEP Right clcik-> Analysis -> Remove Analysis from module
00A1B998 55 PUSH EBP <------------- OEP
well, we don't have stolen bytes, so we are more happy
then before now, less work to do! |
|
4. Dumping our
Unpacked target
|
|
We will dump this program using LordPE (but also OllyDump works fine). Open
LordPE and dump the target full. Now we need to get the import table and fix our
exe . Don't close Olly! |
|
5. Rebuilding our
importable and fixing our exe
|
|
Plesae note that if you don't know how to solve all the
imports we strongly suggest to read the tutorial on
Advanced PDF 2 HTML, released by Ferrari, which link is
at the beginning of this page. There are described the
detailed steps required to fix the IAT..
When there are no invalid imports all we have to do now
is fix our dumped.exe. Click on Fix Dump and select our
dumped.exe and we are done. |
|
6. Removing the
time limit control & the nag
|
|
Method 1 by Shub-Nigurrath: To fix the crashing dump
I hope you have not close Olly. So close Imprec and
LordPE and back in Olly you were at the OEP after the
last RETN. 00A1B998 55 PUSH EBP<-----------------
You were here. Why is this call interesting for us? Because anytime you see a call that uses the [........] at the beginning of the program it will be an ASPR trick to hide the code, so what we have to do for the moment is write down the called place address A257DC to the paper and trace into this call (F7)! The address A257DC contains the real address of the called routine so Olly bring us here
011CC784 833D A8351D01
0>CMP DWORD PTR DS:[11D35A8],0 Ok watch, we are in ASPR code!
011D35A8 A8 A5 A1 00 00 00 00 00 00 00 00 00 00 00 00 00 ¨¥¡............. Ok this means that the CALL we are examining will call
the address
A1A5A8 to go on... if the 30 day expires or you unpack the target at this
address there will be nothing (all zeros) or another address (the address of the
routine which shows the nag), which will bring
the program to tell you that the time is up. 00A1B9FC FF15 DC57A200 CALL DWORD PTR DS:[A257DC] If you trace the program from the EP
with F8 till here you will see that this is the call that makes the program
crashing..if you followed this tut up to here it should be clear why (the
address has been dumped but not the AsProtect corresponding little routine). Original code: 00A1B9FC FF15 DC57A200 CALL DWORD PTR DS:[A257DC] Modified Code: 00A1B9FC E8 A7EBFFFF CALL MyManage.00A1A5A8 So to save the changes permanent Right click-->Copy to executable-->All Modification. Then right click on window that pop's up-->save file, double click on dumped_.exe and select overwrite file. Exit from Olly and run the program, of course it never expires and the 30 days are always 30 and program runs registered 8-) Have phun! Method 2 by Ferrari: To fix the crashing dump All newbies the tutorial ends above itself so just skip this method 2 which will only confuse you ;-) Actually Ferrari was overdosed by ASPR and so stupid was thinking too much when the solution was simple. He forgot the basics lol This method is only for the experts to laugh at me but it does fix the crashing target and makes it registered so don't laugh too much :-P I'm not explaining bcoz you guys are expert enough too understand why this patching (essentially the concept it the same: skip the routine which shows the nag): Make these 4 changes to the final dumped_.exe-->Save-->Run the file. It runs registered. Original code: 00A1B9FC FF15 DC57A200 CALL DWORD PTR DS:[A257DC] Modified Code: 00A1B9FC ^\E9 A7EBFFFF JMP dumped_.00A1A5A8 Original code: 00A1A642 C3 RETN Modified Code: 00A1A642 90 NOP Add code : 00400401 - E9 C23E0000 JMP dumped_.004042C8 Original code: 00A1A5B0 68 43A6A100 PUSH dumped_.00A1A643 Modified Code: 00A1A5B0 68 01044000 PUSH dumped_.00400401
|
|
7. Conclusion
|
|
Lesson Learnt Still awake?!? As usual we try to summarize what we learnt during this tutorial..hope at least one of the points were new for you :) 1. unpack an AsProtect 1.22 program |
|
8. Greetingz
|
|
[MAIN TEAM] [^~=~ (.)Ferrari(.)
~=~^] |