Flag: Tornado! Hurricane!


Packer Name Packer Author Classification Analysis By Last Updated
ASPack 2.12 Alexey Solodovnikov Compressor quig June 15 2005
Allocation Anti-Debug Anti-Disassembly Section Name Sample
PE Header no yes aspack N/A
Notes
This is an easy one to find the OEP of.

Single step through a couple of opcode tricks and into the main unpack loop. You should notice a JNZ to a *very* distant address.

This distant address turns out to be the end of the packer.

Transfer Command
push [patched value]
ret
Entry Point Signature
.aspack:00412001                 public start
.aspack:00412001 start           proc near
.aspack:00412001                 pusha
.aspack:00412002                 call    skipBytes
.aspack:00412002 ; ---------------------------------------------------------------------------
.aspack:00412007                 db 0E9h
.aspack:00412008 ; ---------------------------------------------------------------------------
.aspack:00412008                 jmp     short loc_41200E ; ret address
.aspack:0041200A ; ---------------------------------------------------------------------------
.aspack:0041200A
.aspack:0041200A skipBytes:                              ; CODE XREF: start+1p
.aspack:0041200A                 pop     ebp             ; = fx ret addr after call (412007)
.aspack:0041200B                 inc     ebp
.aspack:0041200C                 push    ebp
.aspack:0041200D                 retn
.aspack:0041200D start           endp ; sp = -20h
.aspack:0041200D

.aspack:0041200E
.aspack:0041200E loc_41200E:                             ; CODE XREF: start+7j
.aspack:0041200E                 call    loc_412014
.aspack:0041200E ; ---------------------------------------------------------------------------
.aspack:00412013                 db 0EBh
.aspack:00412014 ; ---------------------------------------------------------------------------
.aspack:00412014
.aspack:00412014 loc_412014:                             ; CODE XREF: .aspack:loc_41200Ep
.aspack:00412014                 pop     ebp
.aspack:00412015                 mov     ebx, 0FFFFFFEDh
.aspack:0041201A                 add     ebx, ebp
.aspack:0041201C                 sub     ebx, 12000h
.aspack:00412022                 cmp     dword ptr [ebp+422h], 0
.aspack:00412029                 mov     [ebp+422h], ebx
.aspack:0041202F                 jnz     END_OF_PACKER

.aspack:0041239A END_OF_PACKER:                          

.aspack:0041239A                                         
.aspack:0041239A                 mov     eax, 0A870h     ; original entry point offset
.aspack:0041239F                 push    eax
.aspack:004123A0                 add     eax, [ebp+422h] ;add image base to offset
.aspack:004123A6                 pop     ecx
.aspack:004123A7                 or      ecx, ecx
.aspack:004123A9                 mov     [ebp+3A8h], eax ;patch 004123BA to be push [offset]
.aspack:004123AF                 popa
.aspack:004123B0                 jnz     short loc_4123BA
.aspack:004123B2                 mov     eax, 1
.aspack:004123B7                 retn    0Ch             ; error exit ?
.aspack:004123BA ; ---------------------------------------------------------------------------
.aspack:004123BA
.aspack:004123BA loc_4123BA:                             ; CODE XREF: .aspack:004123B0j
.aspack:004123BA                 push    0               ; put a ret addr on stack 
.aspack:004123BF                 retn                    ; ret to pushed address 



Known Unpackers
// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
/* 
Find target's OEP [ ASPack v2.12 ] v0.1
---------------------------------------
Author: DeAtH HaS cOMe #eCh!2004 .:[ CracksLatinos ]:.
Email : death_ech@phreaker.net 
OS : Win XP SP1,OllyDbg 1.10,OllyScript v0.92 
Date : 09.10.2004 
Config: No BreakPoint sets
Note : Any bug or comments, please report at death_ech@phreaker.net
That's all folks!
Un saludo para todo CracksLatinoS, maravillosos listeros, y para mi enana Aur

There are 30,625 total registered users.


Recently Created Topics
Question about debbu...
Apr/16
IDA PRO Struct Point...
Apr/15
problems with pseudo...
Apr/04
Problem with ollydbg
Mar/22
Should binaries be n...
Mar/22
Ida pro on infineon ...
Mar/10
need help about an D...
Feb/25
Stop a VB6 Applicati...
Feb/13
Add one new segment,...
Jan/23
64bit calc.exe Stack...
Jan/19


Recent Forum Posts
Should binaries be n...
Kolisar
Problem with ollydbg
nullx42
!findtrampoline Immu...
skycrack
looking for a softwa...
raxen
Documenting reversed...
raxen
.orpc section what's...
mbin
Pydbg load() issue
phreak
Pydbg load() issue
netw0rm
How would you interp...
mbin
Pydbg load() issue
phreak


Recent Blog Entries
arlenecarter
Apr/21
Easy And Safe Reduction Of ...

oleavr
Apr/17
frida.re 1.2.0 is out, with...

gareebnavas
Jan/21
Android Malware Analysis

oleavr
Dec/21
frida.github.io: scriptable...

chr1x
Nov/05
!apilookup - Win32 API Func...

More ...


Recent Blog Comments
pedram on:
Dec/21
frida.github.io: scriptable...

NeOXQuiCk on:
Nov/26
DONGLE

maharlee on:
Nov/21
Cheap Nike Shoes NZ,Nike Sh...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

newlulu on:
Jun/10
Branch tracing and LBR acce...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit