Comments on: Unpacking ASPack

By: XPN

XPN — Sat, 13 Feb 2010 01:35:26 +0000

Excellent tut mate, just getting into unpacking and this was a good first step.

Thanks again
XPN

By: msrll continued « SecureArtisan

msrll continued « SecureArtisan — Mon, 03 Aug 2009 21:58:13 +0000

[...] I found a manual unpacking method here [...]

By: shinku

shinku — Sat, 25 Jul 2009 05:26:52 +0000

Hi korupt whats up

Well I’m studying RE stuff nowadays and i’d like to know why imprec crashes everytime I change the size to the one he tells me to put 000a9000.

By default he puts this size: 00000640 and tells me if it not work i must change it to 000a9000, so when i fix the dumped file it tells me “iat is still invalid”

any idea how to solve it buddy? i’m trying to remove some invalid pointers with olly but its bothering and i do not know how many ppointers are corrupted

tomorrow i’ll be at #io hope to find you there

[]’s

Shinku

By: jack

jack — Tue, 12 May 2009 15:06:02 +0000

https://download.yousendit.com/U0d5L0dPdzhqV0JMWEE9PQ

can you check this please,,,,it is a dll packed with aspack,,,,,,it is protected and my aplication can run
it crash because the protection but i can´t see why,,,,,,,thnks a lot,,,,

By: Konstantine

Konstantine — Wed, 06 May 2009 00:29:34 +0000

Hi man ! I see you are avesome at this cap. I try to remove the limitation of 12th century blackjack (a small yet funny game) but i cant.. i am faced with AsProtect 2.1 x ske i tried stripper (latest version) but fails quick and ollydbg + ImpRec (both latest version) ..which also fails but i know should work, i think i am not so smart to use corectly Please could you help me to remove this limitation ? Throw a look and say to me if is so easy as it seems (for me dont seems so easy). I uploaded the file on: http://rapidshare.com/files/229631269/MEDIEVAL_BLACKJACK.zip.html (3.8mb). Many Thanks man !

By: ThunderLord

ThunderLord — Sun, 05 Apr 2009 00:30:27 +0000

Thanks man, It works perfectly

By: KOrUPt

KOrUPt — Tue, 17 Feb 2009 17:13:20 +0000

I don’t have any specifics to provide decent advice… How come the tutorials were of no use? Are you sure this is ASPack you’re dealing with and not ASProtect or similar?

I don’t have the time at the moment to take a shot at unpacking it for you. Sorry.

KOrUPt.

By: Gonzo

Gonzo — Mon, 16 Feb 2009 16:26:44 +0000

Hi my friend, I am in a problem trying to remove AsPack 2.12 from a well protected video codec dll file. I have tried lot tutorials and tools but no good luck. My skills are very basic on this and I shall really thanks a lot if you can guide me.

Regards,

Gonzo

By: KOrUPt

KOrUPt — Wed, 28 Jan 2009 16:54:14 +0000

You haven’t provided enough information for me to give you reliable advice.

Please upload the file in question and provide a description as what it’s for.

KOrUPt.

By: Myrmidon

Myrmidon — Tue, 27 Jan 2009 22:46:55 +0000

Hi I have a problem unpacking aspacked dll (2.12)

Can U help me look at the file ?

I suspect that the OEP is here somewhere but ImportREC cannot find any usefull OEP :

008C93D4 55 PUSH EBP

iz ovoga:
008C93C5 E8 82CCFBFF CALL gamedrv_.0088604C
008C93CA C3 RETN
008C93CB 90 NOP
008C93CC 832D 803A8D00 01 SUB DWORD PTR DS:[8D3A80],1
008C93D3 C3 RETN
008C93D4 55 PUSH EBP
008C93D5 8BEC MOV EBP,ESP
008C93D7 83C4 C4 ADD ESP,-3C
008C93DA B8 BC7E8C00 MOV EAX,gamedrv_.008C7EBC
008C93DF E8 B0D4FAFF CALL gamedrv_.00876894
008C93E4 33C0 XOR EAX,EAX
008C93E6 55 PUSH EBP
008C93E7 68 14948C00 PUSH gamedrv_.008C9414
008C93EC 64:FF30 PUSH DWORD PTR FS:[EAX]
008C93EF 64:8920 MOV DWORD PTR FS:[EAX],ESP
008C93F2 B8 98878800 MOV EAX,gamedrv_.00888798
008C93F7 A3 F4078D00 MOV DWORD PTR DS:[8D07F4],EAX
008C93FC B8 01000000 MOV EAX,1
008C9401 E8 92F3FBFF CALL gamedrv_.00888798
008C9406 33C0 XOR EAX,EAX
008C9408 5A POP EDX
008C9409 59 POP ECX
008C940A 59 POP ECX