Manual Unpacking For Newbies by ACiD BuRN


yo !!
today , i will explain u how to unpack manually , but i take an app
, freware , packed with aspack or something , i don't care hehe !!
i will only show u how to have the string data reference in the app
, so no import table , but i don't care , Newbies tutors , don't forget
with this , you can patch the exe , so i think you will be happy :)


Tools needed : - Soft ice 3.x or 4
	       - Procdump 1.5 (only used as Files Dumped)



1st part : The loader!


u will use the loader of Sice to unpack , so Run it (loader32.exe)
and choose the exe u want to run!
for us , it is : Konix.exe.
ok , run it with the loader , but the prob is , this fucking app
won't break in Sice :(
hehe , np , run Proc Dump and use PE editor !
Edit the Code's section of the exe.
(pe editor , choose the file , sections , click on CODE and right 
click , edit section )

ok , you see in sections caracteristic : C0000040
ok , change it to : E0000020

Don't nag me for ask me why , only trust me , this work all the time!
do it , that's all!

now , run the Loader of sice , run the app with it , and it will break
in Sice :))
great , worked hehe


2nd part : tracing and dumping the file from memory to the disk!

ok , so u just breaked on sice , u see invalid shit , but doesn't
matter.trace with F10 u will arrive here :

XXXXXXXX   PUSHAD        <-- when u unpack , if you see this , :)
XXXXXXXX   CALL 45A006
XXXXXXXX   POP EBP
XXXXXXXX   SUB EBP,43D93E
............

XXXXXXXX   CALL 0045A051
XXXXXXXX   CALL 0045A2B2
XXXXXXXX   CALL 0045A350

............

XXXXXXXX   POPAD       <-- Good to see this too :)
XXXXXXXX   JMP EAX     <-- Stop tracing here, coz it jump the real prog

.......


Well.. when u unpack u see some POPAD and a JMP , look for one who jump
to a register like EAX , EDX , ECX ...
but it is really often : EAX

ok , so when u are at the JMP EAX place , look the value on EAX and
writte it down on a paper for me it was : 43F0A0.You will use this soon
tust me !! heh
To know if you are at the good place , try to F10 once and look if it
jump to the real entry point of the programme.
For us , he did , so it is ok !


NOW , exit Sice , and re run the exe with the sice loader , and trace
to the Jump place.
NOW , type : 
A       {enter}  <== this is to change the code at the current place
JMP EIP {enter}  <== this is for make a unlimited Loop , like this 
                     we can dump the file , without dumping shit
{escape}
F5
now the programme is doing an unfinite loop in Memory and we can dump
now !!!
ok , run procdump and you see in the main form the list of the curent
task , click on the one who contain Konix.exe. Now right click
and chose Full Dump.save the new exe with the name you want.
ex : Konixdumped.exe

now , click on it again , right click and do : kill task instead of 
dump , this will kill this task and end the programme who is still 
doing the unlimited Loop.


3rd parts : fix the programme entry point!


ok , look ate the exe u just have dumped , and you see the size is
bigger than the packed , great :)
but wait , if you run it , the prog will crash like a silly bastard:(
ok , u remember , u have noted the OEP (original entry point) on a
paper , the value you found in EAX. in this case , it was : 43F0A0
ok Run the Procdump's PE editor again and change the entry point 
to 0x0003F0A0. (OEP - the image base : 43F0A0-400000=3F0A0)
i said you this number will help us !! hehe
now , close procdump , and the you unpacked / dumped executable
IT WORKS !!!!!!!!!!!!!!!!!!!!

yea , we did it !! hehe
Now Wdasm it and you will have String Data references :)
u can patch it now !! heh!!
Well , this tut is finish , hope u understand all this piece of
text , but if you have a comment or one question, mail me to :
ACiD_BuRN@nema.com or acid2600@caramail.com.

have Fun and happy cracking !


greets to my groups : ECLiPSE / PWA / CiA / oDDiTY
also greetingz to:

R!SC, ^Inferno^, AB4DS, Cyber Blade, Klefz, , Volatility, Torn@do, T4D
Jeff, [Virus], JaNe , Appbusta , Duelist , tKC , BuLLeT , Lucifer48 , 
MiZ , DnNuke , Bjanes , Skymarshall , afkayas , elmopio , SiFLyiNG , 
Fire Worx , Crackz , neural_en ...


Sorry if you are not here too many people to greetz !!!)